HP vulnerabilities
We track 168 vulnerabilities in HP products across 60+ products. 168 are rated high or critical, and 7 have been exploited in real attacks. The most recent was published on October 23, 2026.
Latest HP vulnerabilities
- 8.2 High severity
AOS-8 Instant and AOS-10 AP: Deletion of Data Structure Sentinel
There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlyin
- 8.2 High severity
AOS-8 Instant and AOS-10 AP: Deletion of Data Structure Sentinel
There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system,
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211).
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211).
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management p
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful ex
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful ex
- 7.7 High severity
HP software packages (SoftPaqs): Improper Control of Generation of Code
Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extraction. HP has released updated software packages (SoftPaqs).
- 8.3 High severity
HPE NonStop Web ViewPoint Enterprise software: Exposure of Sensitive Information to an Unauthorized Actor
A potential security vulnerability has been identified in Web ViewPoint Enterprise software. This vulnerability could be exploited to allow unauthorized users to access some resources on a NonStop system.
- 8.8 High severity
Poly CCX devices: Missing Authentication for Critical Functionality
A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor.
- 8.2 High severity
HP PC BIOS: Observable Discrepancy
A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability.
- 7.5 High severity
HP DesignJet: Out-of-bounds Read
Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when using the general-purpose gateway (GGW) over port 9220.
- 8.2 High severity
HP ThinPro 8.0: Improper Restriction of Operations within the Bounds of a Memory Buffer
Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. HP has released HP ThinPro 8.0 SP 8, which includes updates to mitigate potential vulnerabilities.
- 9.8 Critical severity
Certain LaserJet Pro, HP Enterprise LaserJet…: Out-of-bounds Read
Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file.
- 7.5 High severity
HPE System Management Homepage (SMH): Exposure of Sensitive Information to an Unauthorized Actor
A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely to disclose information.
- 7.2 High severity
Aruba Access Points: 100 Series; 103 Series…: Incorrect Authorization
An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.
- 7.2 High severity
Aruba Access Points: 100 Series; 103 Series…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.5 High severity
Aruba Access Points: 100 Series; 103 Series…: Uncontrolled Resource Consumption
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
- 7.5 High severity
Aruba Access Points: 100 Series; 103 Series…: Uncontrolled Resource Consumption
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point.
- 9.8 Critical severity
Aruba Access Points: 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Suc
- 9.8 Critical severity
Aruba Access Points: 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful ex
- 9.8 Critical severity
Aruba Access Points: 100 Series; 103 Series…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful ex
- 7.8 High severity
HP Print and Scan Doctor for Windows: Improper Privilege Management
HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.
- 7.5 High severity
HP ThinUpdate: Improper Certificate Validation
A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download Tool) which may lead to information disclosure. HP is releasing mitigation for the potential vulnerability.
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
Aruba Access Points running InstantOS and…: Buffer Copy without Checking Size of Input
There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port (8211). Successful
- 9.8 Critical severity
HP LaserJet Pro: Missing Authorization
Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints.
- 8.8 High severity
HP LaserJet Pro: Buffer Copy without Checking Size of Input
Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Denial of Service when using the backup & restore feature through the embedded web service on the device.
- 9.8 Critical severity
HP LaserJet Pro: Server-Side Request Forgery
Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.
- 7.0 High severity
HP PC products using AMI UEFI Firmware: Time-of-check Time-of-use (TOCTOU) Race Condition
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
- 9.8 Critical severity
HP multifunction printers: Buffer Copy without Checking Size of Input
A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Buffer Overflow and/or Remote Code Execution when running HP Workpath solutions on potentially affected products.
- 7.8 High severity
HP PC BIOS: Incorrect Authorization
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Concurrent Execution using Shared Resource with Improper Synchronization
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.8 High severity
HP PC BIOS: Incorrect Authorization
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.0 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
- 7.0 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.