HPE Aruba Patches High-Severity Credential Theft Flaw

HPE Aruba Networking disclosed a high-severity open-redirect vulnerability (CVE-2026-23818, CVSS 8.8) in its Private 5G Core On-Prem GUI that could redirect authenticated users to attacker-controlled spoofed login pages to capture credentials; affected versions are 1.25.3.0 and below, and HPE released a patch (1.25.3.1+) while recommending network isolation and enhanced monitoring as mitigations; no public exploit activity was reported at disclosure.