CVE-2016-8526

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 8.2.3.1.

CVSS 3.08.8High EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix8.2.3.1Upgrade to this build

Published 2018-08-06Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Hewlett Packard Enterprise Aruba AirWaveAffected: all versions up to, but not including, 8.2.3.1Upgrade to: not statedStated by: CVE record
Hp AirwaveAffected: < 8.2.3.1Upgrade to: 8.2.3.1Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of Aruba Airwave your organization is running.
If it is any version before 8.2.3.1, plan an upgrade.
Upgrade Aruba Airwave to version 8.2.3.1 or later.
Review Aruba's advisory (ARUBA-PSA-2017-001) for upgrade and configuration guidance.
Restrict who has login access to Airwave until the upgrade is complete.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.

In plain language

Written by AI from the record

A security flaw in Aruba Airwave (versions before 8.2.3.1) could let a logged-in attacker steal sensitive files, including passwords, from the server — businesses running this network management tool should update soon.

Aruba Airwave before 8.2.3.1 is vulnerable to XML External Entity (XXE) injection allowing a low-privileged authenticated user to force the XML parser to read arbitrary local files (e.g. credential stores) accessible to the web server, enabling privilege escalation.

If you're affected

Credential theft
Privilege escalation
Sensitive file disclosure
Network management system compromise

What is it

Aruba Airwave is a tool IT teams use to manage and monitor their business's Wi-Fi and network equipment. This flaw is like leaving a side door unlocked inside a building — someone who already has a basic employee badge (a valid login) can slip through it to reach a filing cabinet they shouldn't, pulling out documents like passwords stored on the server. From there, they could use those stolen credentials to gain much higher access.

Who is affected

This matters to you if your organization runs Aruba Airwave for network management, on any version earlier than 8.2.3.1. The risk applies if an attacker — or a malicious insider — already has a valid, even low-level, account on the system; it is not something a random outsider with no login can exploit directly.

How urgent is it

A working exploit for this flaw is publicly available and press attention is rising, which raises the chance it gets used, though there is no confirmed record of attackers actively exploiting it in the wild yet. Given the exploit's availability and the sensitivity of what it can expose (stored passwords), this should be treated as a priority to fix soon rather than an emergency to drop everything for.

What to do — in detail

Inventory all Aruba Airwave instances and identify their current version.
Any instance running a version prior to 8.2.3.1 is vulnerable to this XXE issue (CWE-611).
Upgrade to 8.2.3.1 or later; consult Aruba's advisory ARUBA-PSA-2017-001 for the upgrade path and any configuration notes.
If immediate upgrade isn't possible, reduce exposure by limiting which accounts can submit or edit XML content within Airwave, and restrict administrative/low-privilege account creation.
After upgrading, review web server and application logs for any unusual outbound connections or file-read errors predating the patch, which could indicate prior exploitation attempts.
No CISA KEV entry or due date exists for this CVE at this time; treat remediation on your organization's normal patch-priority timeline given the public exploit availability.

Technical context

CVSS 3.0 score 8.8 (High), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, requires low-privilege authentication, no user interaction, with high impact to confidentiality, integrity, and availability. Weakness type is CWE-611 (XXE), where the XML parser resolves external entities and discloses local files readable by the web server process, potentially including credential material usable for privilege escalation. One public exploit is known to exist; the vulnerability is not listed in CISA's KEV catalog, so no confirmed in-the-wild exploitation has been recorded. EPSS places predicted exploitation likelihood in a high percentile relative to all CVEs, though this is a prediction, not confirmed activity. Exploit maturity is at proof-of-concept/public-exploit stage with rising press attention.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-10-11EPSS band changelow → moderateepss band change
2026-06-22EPSS band changemoderate → low
2026-03-06Public exploit / PoCsource: exploit-db
2024-11-21Patch availablerecord updated
2018-08-06Publishedweakness classified, att&ck mapped

Affected products

hpcommercial · USaka hpe, hewlett packard
- airwaveWeb AppOn-premNetworking Infrastructure / network-management
Hewlett Packard Enterprisecommercial · USaka hpe
- Aruba AirWaveNetworking Infrastructure

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable