Hewlett Packard Enterprise vulnerabilities
We track 492 vulnerabilities in Hewlett Packard Enterprise products across 60+ products. 492 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Hewlett Packard Enterprise vulnerabilities
- 9.1 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.
- 9.3 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.
- 9.6 Critical severity
AOS-Switch (AOS-S): Improper Restriction of Operations within the Bounds of a Memory Buffer
Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.
- 9.8 Critical severity
AOS-Switch (AOS-S): Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
- 9.8 Critical severity
AOS-Switch (AOS-S): Improper Authentication
A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Success
- 9.8 Critical severity
AOS-Switch (AOS-S): Improper Privilege Management
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
- 7.2 High severity
Instant ON: Server-Side Request Forgery
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary
- 7.2 High severity
Instant ON: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbit
- 8.1 High severity
Instant ON: Improper Authentication
An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation
- 9.6 Critical severity
Instant ON: Improper Authentication
A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of sec
- 9.6 Critical severity
Instant ON: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attack
- 9.6 Critical severity
Instant ON: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary comman
- 9.8 Critical severity
Instant ON: Use of Externally-Controlled Format String
Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-o
- 9.8 Critical severity
Instant ON: Improper Restriction of Operations within the Bounds of a Memory Buffer
Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary c
- 7.1 High severity
ALE: Channel Accessible by Non-Endpoint
A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code wit
- 7.2 High severity
ALE: Improper Neutralization of Special Elements used in an OS Command
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operatin
- 7.2 High severity
ALE: Improper Privilege Management
A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileg
- 7.3 High severity
ALE: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or
- 7.5 High severity
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted…
A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input dur
- 7.5 High severity
ALE: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to cert
- 9.8 Critical severity
ALE: Improper Access Control
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with eleva
- 9.8 Critical severity
ALE: Use of Hard-coded Credentials
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vu
- 7.0 High severity
EdgeConnect SD-WAN Gateways: Uncontrolled Resource Consumption
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways.
- 7.1 High severity
EdgeConnect SD-WAN Gateways: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal operation of the affected service. Successful exploitation could result in a denial
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Improper Neutralization of Special Elements used in an OS Command
A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected com
- 7.2 High severity
EdgeConnect SD-WAN Gateways: Stack-based Buffer Overflow
A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafte
- 7.5 High severity
EdgeConnect SD-WAN Gateways: Improper Authentication
Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an at
- 7.5 High severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary s
- 7.5 High severity
EdgeConnect SD-WAN Gateways: Uncontrolled Resource Consumption
A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an unauthenticated remote attacker to conduct a denial-of-service attack on the affected service.
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Integer Overflow or Wraparound
A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that trig
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Improper Authentication
Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to ga
- 8.1 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's cont
- 8.2 High severity
EdgeConnect SD-WAN Gateways: Buffer Copy without Checking Size of Input
A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or pot
- 8.5 High severity
EdgeConnect SD-WAN Gateways: Improper Access Control
A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow
- 8.5 High severity
EdgeConnect SD-WAN Gateways: Server-Side Request Forgery
Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks. A successful exploit allows an attacker to enumerate information about the inte
- 8.6 High severity
EdgeConnect SD-WAN Gateways: Uncontrolled Resource Consumption
Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manua
- 8.8 High severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary syste
- 8.8 High severity
EdgeConnect SD-WAN Gateways: Improper Privilege Management
A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticated user to achieve administrative privilege on the web-management interface leading to complete system
- 8.8 High severity
EdgeConnect SD-WAN Gateways: Stack-based Buffer Overflow
Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met. Successf