HPE Aruba Private 5G Core Vulnerability Exposes Admin Credentials via Phishing-Style Attack
A critical vulnerability in HPE Aruba Networking’s Private 5G Core On-Prem platform, tracked as CVE-2026-23818, has been disclosed, enabling attackers to steal administrative credentials through a sophisticated phishing-style exploit. The flaw, detailed in HPE security bulletin HPESBNW05032EN_US, affects the platform’s graphical user interface (GUI) and stems from an open redirect vulnerability in the login workflow.
The issue arises from inadequate sanitization of redirect parameters, allowing threat actors to manipulate post-authentication navigation. Attackers exploit this by crafting malicious URLs that appear legitimate, tricking users typically network administrators into clicking them. Upon interaction, the victim is redirected to an attacker-controlled server hosting a fake login page designed to mimic the authentic Aruba interface. Unsuspecting users re-enter their credentials, which are then captured before being seamlessly redirected back to the real login page, making the attack difficult to detect.
The impact of CVE-2026-23818 is severe for enterprises relying on private 5G infrastructure. Compromised credentials could grant attackers unauthorized access to network configurations, enable interception or manipulation of sensitive communications, disrupt services, or facilitate lateral movement within corporate environments. Since the attack relies on social engineering rather than malware, traditional endpoint security tools may fail to detect it.
HPE has released patches to address the vulnerability, urging organizations to update affected systems immediately. The flaw underscores the growing threat to user-facing interfaces in private 5G deployments, where attackers increasingly target authentication workflows to bypass security controls.
Source: https://cyberpress.org/hpe-aruba-private-5g-platform-vulnerability/
HPE Aruba Networking cybersecurity rating report: https://www.rankiteo.com/company/aruba-a-hewlett-packard-enterprise-company
"id": "ARU1775831194",
"linkid": "aruba-a-hewlett-packard-enterprise-company",
"type": "Vulnerability",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Enterprises relying on private '
'5G infrastructure',
'industry': 'Telecommunications/Networking',
'name': 'HPE Aruba Networking',
'type': 'Technology Vendor'}],
'attack_vector': 'Malicious URLs (Open Redirect)',
'data_breach': {'sensitivity_of_data': 'High (Network admin credentials)',
'type_of_data_compromised': 'Administrative credentials'},
'description': 'A critical vulnerability in HPE Aruba Networking’s Private 5G '
'Core On-Prem platform, tracked as CVE-2026-23818, enables '
'attackers to steal administrative credentials through a '
'sophisticated phishing-style exploit. The flaw affects the '
'platform’s graphical user interface (GUI) and stems from an '
'open redirect vulnerability in the login workflow. Attackers '
'craft malicious URLs to redirect users to a fake login page, '
'capturing credentials before redirecting them back to the '
'real login page, making the attack difficult to detect.',
'impact': {'data_compromised': 'Administrative credentials',
'operational_impact': 'Unauthorized access to network '
'configurations, interception/manipulation '
'of sensitive communications, service '
'disruption, lateral movement',
'systems_affected': 'HPE Aruba Private 5G Core On-Prem GUI'},
'post_incident_analysis': {'corrective_actions': 'Patch release to address '
'open redirect vulnerability',
'root_causes': 'Inadequate sanitization of '
'redirect parameters in the GUI '
'login workflow'},
'recommendations': 'Update affected systems immediately to patch '
'CVE-2026-23818. Enhance user training to recognize '
'phishing-style attacks targeting authentication '
'workflows.',
'references': [{'source': 'HPE Security Bulletin',
'url': 'HPESBNW05032EN_US'}],
'response': {'communication_strategy': 'Security bulletin HPESBNW05032EN_US',
'remediation_measures': 'Patches released by HPE'},
'title': 'HPE Aruba Private 5G Core Vulnerability Exposes Admin Credentials '
'via Phishing-Style Attack',
'type': 'Phishing-Style Exploit',
'vulnerability_exploited': 'CVE-2026-23818 (Open Redirect in GUI Login '
'Workflow)'}