Hewlett Packard Enterprise vulnerabilities
We track 492 vulnerabilities in Hewlett Packard Enterprise products across 60+ products. 492 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Hewlett Packard Enterprise vulnerabilities
- 7.2 High severity
Fabric Composer: Improper Neutralization of Special Elements used in an SQL Command
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify
- 7.2 High severity
Fabric Composer: Improper Neutralization of Special Elements used in an OS Command
Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the under
- 7.2 High severity
Fabric Composer: External Control of File Name or Path
An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary sy
- 7.4 High severity
Fabric Composer: Cross-Site Request Forgery
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specia
- 7.5 High severity
Fabric Composer: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attack
- 7.5 High severity
Fabric Composer: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attac
- 7.5 High severity
Fabric Composer: Uncontrolled Resource Consumption
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.
- 7.6 High severity
Fabric Composer: Improper Privilege Management
A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege lev
- 7.8 High severity
Fabric Composer: Improper Privilege Management
Local privilege-escalation vulnerabilities have been discovered in HPE Networking Fabric Composer. Successful exploitation of these vulnerabilities could allow a local attacker to achieve arbitrary code execution with root privileges on the underlying operatin
- 8.1 High severity
Fabric Composer: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vul
- 8.1 High severity
Fabric Composer: Improper Privilege Management
A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fab
- 8.2 High severity
Fabric Composer: Missing Authentication for Critical Functionality
Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underly
- 8.3 High severity
Fabric Composer: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successfu
- 8.3 High severity
Fabric Composer: Incorrect Authorization
A business logic vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to obtain elevated privileges and modify settings beyond what is authorized by the user's exist
- 8.5 High severity
Fabric Composer: Incorrect Authorization
Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of au
- 8.6 High severity
Fabric Composer: Missing Authentication for Critical Functionality
A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obtain limited system information and to change the state of certain settings of a vulnerable system. Successful exploitation could allow an attacker
- 8.8 High severity
Fabric Composer: Files or Directories Accessible to External Parties
An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary comma
- 8.8 High severity
Fabric Composer: Improper Neutralization of Special Elements used in a Command
A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise
- 8.8 High severity
Fabric Composer: Improper Neutralization of Input During Web Page Generation
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an
- 8.8 High severity
Fabric Composer: Incorrect Authorization
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete sys
- 9.0 Critical severity
Fabric Composer: Improper Control of Generation of Code
An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulner
- 9.0 Critical severity
Fabric Composer: Improper Neutralization of Input During Web Page Generation
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful
- 9.6 Critical severity
Fabric Composer: Improper Authentication
An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operat
- 9.8 Critical severity
EdgeConnect SD-WAN Orchestrator: Improper Authentication
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view
- 9.8 Critical severity
EdgeConnect SD-WAN Orchestrator: Missing Authentication for Critical Functionality
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view
- 7.2 High severity
EdgeConnect SD-WAN Gateway (ECOS): Improper Neutralization of Special Elements used in a Command
A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on
- 7.2 High severity
A vulnerability in the web-based management interface of an ECOS device could allow a highly…
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive
- 7.2 High severity
AOS-CX: Improper Limitation of a Pathname to a Restricted Directory
An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could
- 7.2 High severity
AOS-CX: Buffer Copy without Checking Size of Input
Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system.
- 8.8 High severity
AOS-CX: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute ar
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected dev
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute ar
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 8.8 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying o
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by