CVE-2026-23595
Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation
- State
- Published
- Severity
- 8.8 High
- Published
- Feb 17, 2026
- Updated
- Feb 18, 2026
- Reserved
- Jan 14, 2026
Description
An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | hpe |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
HPE Aruba Networking Private 5G CoreHewlett Packard Enterprise (HPE) |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.