Hewlett Packard Enterprise vulnerabilities
We track 492 vulnerabilities in Hewlett Packard Enterprise products across 60+ products. 492 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Hewlett Packard Enterprise vulnerabilities
- 7.2 High severity
ArubaOS (AOS): Improper Access Control
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying o
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands o
- 7.5 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt
- 7.5 High severity
ArubaOS (AOS): Uncontrolled Resource Consumption
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.
- 7.5 High severity
ArubaOS (AOS): Uncontrolled Resource Consumption
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.
- 7.5 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.
- 7.8 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.
- 8.1 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful ex
- 8.1 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privile
- 8.1 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands
- 8.1 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system,
- 8.1 High severity
ArubaOS (AOS): Improper Control of Generation of Code
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of c
- 8.2 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its in
- 8.2 High severity
ArubaOS (AOS): Improper Authentication
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affect
- 8.2 High severity
ArubaOS (AOS): Improper Authentication
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some
- 8.3 High severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to poten
- 8.3 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker
- 8.3 High severity
ArubaOS (AOS): Improper Authentication
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a pri
- 8.7 High severity
ArubaOS (AOS): Server-Side Request Forgery
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on th
- 8.8 High severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying
- 8.8 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successfu
- 8.8 High severity
ArubaOS (AOS): Improper Control of Generation of Code
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands a
- 9.3 Critical severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be us
- 9.3 Critical severity
ArubaOS (AOS): Improper Authentication
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, m
- 9.3 Critical severity
ArubaOS (AOS): Improper Authentication
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or
- 9.3 Critical severity
ArubaOS (AOS): Improper Authentication
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system c
- 9.4 Critical severity
ArubaOS (AOS): Stack-based Buffer Overflow
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arb
- 9.6 Critical severity
ArubaOS (AOS): Exposure of Sensitive Information to an Unauthorized Actor
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used
- 9.6 Critical severity
ArubaOS (AOS): Improper Authentication
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system c
- 9.6 Critical severity
ArubaOS (AOS): Improper Authentication
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privil
- 9.6 Critical severity
ArubaOS (AOS): Improper Authentication
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify syst
- 9.6 Critical severity
ArubaOS (AOS): Improper Authentication
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an a
- 9.6 Critical severity
ArubaOS (AOS): Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.
- 9.6 Critical severity
ArubaOS (AOS): Improper Restriction of Operations within the Bounds of a Memory Buffer
A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the under
- 9.6 Critical severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user o
- 9.6 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker
- 9.6 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker
- 9.8 Critical severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privile
- 9.8 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful expl
- 9.8 Critical severity
ArubaOS (AOS): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system