Aruba Networks vulnerabilities
We track 261 vulnerabilities in Aruba Networks products across 21 products. 261 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on September 22, 2026.
Latest Aruba Networks vulnerabilities
- 7.1 High severity
ALE: Channel Accessible by Non-Endpoint
A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code wit
- 7.2 High severity
ALE: Improper Neutralization of Special Elements used in an OS Command
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operatin
- 7.2 High severity
ALE: Improper Privilege Management
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileg
- 7.3 High severity
ALE: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or
- 7.5 High severity
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted…
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input dur
- 7.5 High severity
ALE: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to cert
- 9.8 Critical severity
ALE: Improper Access Control
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with eleva
- 9.8 Critical severity
ALE: Use of Hard-coded Credentials
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vu
- 7.0 High severity
EdgeConnect SD-WAN Gateways: Uncontrolled Resource Consumption
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways.
- 7.1 High severity
EdgeConnect SD-WAN Gateways: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal operation of the affected service. Successful exploitation could result in a denial
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Improper Neutralization of Special Elements used in an OS Command
A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected com
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Stack-based Buffer Overflow
A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafte
- 7.5 High severity
EdgeConnect SD-WAN Gateways: Improper Authentication
Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an at
- 7.5 High severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary s
- 7.5 High severity
EdgeConnect SD-WAN Gateways: Uncontrolled Resource Consumption
A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an unauthenticated remote attacker to conduct a denial-of-service attack on the affected service.
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Integer Overflow or Wraparound
A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that trig
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Improper Authentication
Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to ga
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's cont
- 8.2 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or pot
- 8.5 High severity
EdgeConnect SD-WAN Gateways: Improper Access Control
A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow
- 8.5 High severity
EdgeConnect SD-WAN Gateways: Server-Side Request Forgery
Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the inte
- 8.6 High severity
EdgeConnect SD-WAN Gateways: Uncontrolled Resource Consumption
Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manua
- 8.8 High severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary syste
- 8.8 High severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system
- 8.8 High severity
EdgeConnect SD-WAN Gateways: Stack-based Buffer Overflow
Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met. Successf
- 9.1 Critical severity
EdgeConnect SD-WAN Gateways: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system le
- 9.8 Critical severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arb
- 9.8 Critical severity
EdgeConnect SD-WAN Gateways: Improper Authentication
Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrati
- 9.9 Critical severity
EdgeConnect SD-WAN Gateways: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the ca
- 9.9 Critical severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to
- 9.9 Critical severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute ar
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected dev
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute ar
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o