CVE-2026-23595
Published: 17 February 2026
Summary
CVE-2026-23595 is a high-severity Improper Access Control (CWE-284) vulnerability in Hpe Aruba Networking Private 5G Core. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Create Account (T1136); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-23595, published on 2026-02-17, is an authentication bypass vulnerability (CWE-284: Improper Access Control) in the application API. It has a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw affects an HPE product, as detailed in the vendor's security bulletin.
A remote attacker with adjacent network access can exploit this vulnerability without privileges or user interaction. Exploitation allows creation of unauthorized administrative accounts, leading to full administrative access. This enables modification of system configurations and access or manipulation of sensitive data.
The HPE security advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05002en_us&docLocale=en_US provides details on mitigation and patching.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8093
Vulnerability details
An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations,…
more
and access or manipulate sensitive data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Auth bypass in API directly enables unauthorized admin account creation (T1136) via exploitation of remote service (T1210).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly preventing authentication bypass that allows unauthorized API access to create administrative accounts.
Requires unique identification and authentication of organizational users before access, mitigating the authentication bypass vulnerability in the application API.
Manages system accounts including creation, approval, and monitoring to prevent unauthorized privileged account establishment via the exploited API.