HPE Aruba Private 5G Core - Security Policy Bypass Vulnerability
Summary
CERT-FR issued a security advisory warning of a vulnerability (CVE-2026-23818) in HPE Aruba Networking Private 5G Core versions prior to 1.25.3.1. The flaw allows attackers to bypass security policies. Organizations using the affected product must apply patches referenced in HPE security bulletin HPESBNW05032.
What changed
CERT-FR published advisory CERTFR-2026-AVI-0402 alerting organizations to a security policy bypass vulnerability in HPE Aruba Networking Private 5G Core. Tracked as CVE-2026-23818, the flaw affects all versions prior to 1.25.3.1. The vulnerability allows an attacker to circumvent security policies, potentially gaining unauthorized access or disrupting network protections. Organizations running the affected 5G core infrastructure should immediately reference HPE's security bulletin for patch availability and apply updates as soon as possible to mitigate exploitation risk.
Affected parties include telecommunications providers and enterprises deploying private 5G networks using Aruba's core platform. Failure to patch exposes networks to policy bypass attacks that could compromise 5G connectivity security, user authentication, or traffic filtering. Security teams should audit their Aruba deployments, identify affected versions, and prioritize patching within standard vulnerability management SLAs. No specific regulatory penalties are cited, but the advisory aligns with EU and French network security obligations requiring timely remediation of known vulnerabilities.
What to do next
- Apply patches from HPE Aruba security bulletin HPESBNW05032
- Update Aruba Networking Private 5G Core to version 1.25.3.1 or later
- Monitor for updated CVE details at cve.org
Archived snapshot
Apr 8, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Premier Ministre S.G.D.S.N
Agence nationale
de la sécurité des
systèmes d'information
Paris, le 08 avril 2026 N° CERTFR-2026-AVI-0402 Affaire suivie par: CERT-FR
Avis du CERT-FR
Objet: Vulnérabilité dans HPE Aruba Networking Private 5G Core
Gestion du document
| Référence | CERTFR-2026-AVI-0402 |
| Titre | Vulnérabilité dans HPE Aruba Networking Private 5G Core |
| Date de la première version | 08 avril 2026 |
| Date de la dernière version | 08 avril 2026 |
| Source(s) | Bulletin de sécurité HPE Aruba Networking HPESBNW05032 du 07 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.
Risque
- Contournement de la politique de sécurité
Systèmes affectés
- Aruba Networking Private 5G Core versions antérieures à 1.25.3.1
Résumé
Une vulnérabilité a été découverte dans HPE Aruba Networking Private 5G Core. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Documentation
- Bulletin de sécurité HPE Aruba Networking HPESBNW05032 du 07 avril 2026
- https://csaf.arubanetworking.hpe.com/2026/hpe_aruba_networking_-_hpesbnw05032.txt
- Référence CVE CVE-2026-23818
- https://www.cve.org/CVERecord?id=CVE-2026-23818
Gestion détaillée du document
- le 08 avril 2026 Version initiale
Related changes
Get daily alerts for CERT-FR Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.
The plain-English summary, classification, and "what to do next" steps are AI-generated from the original text. Cite the source document, not the AI analysis.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-FR Security Advisories publishes new changes.