Hewlett Packard Enterprise vulnerabilities
We track 492 vulnerabilities in Hewlett Packard Enterprise products across 60+ products. 492 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Hewlett Packard Enterprise vulnerabilities
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Stack-based Buffer Overflow
Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially
- 7.2 High severity
HPE Aruba Networking Wireless Operating System…: Improper Following of a Certificate's Chain of Trust
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the under
- 7.5 High severity
HPE Aruba Networking Wireless Operating System…: Heap-based Buffer Overflow
A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execu
- 7.5 High severity
HPE Aruba Networking Wireless Operating System…: Allocation of Resources Without Limits or Throttling
A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-ser
- 7.5 High severity
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input valid
- 7.5 High severity
HPE Aruba Networking Wireless Operating System…: Uncontrolled Resource Consumption
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input valid
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating s
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbi
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execut
- 8.8 High severity
ArubaOS (AOS): Improper Neutralization of Input During Web Page Generation
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploita
- 9.6 Critical severity
Private 5G Core: URL Redirection to Untrusted Site
A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulnerability in the login flow using a crafted URL. Successful exploitation may re
- 8.8 High severity
AOS-CX: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
- 7.2 High severity
AOS-CX: Improper Neutralization of Special Elements used in a Command
A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.
- 8.8 High severity
AOS-CX: Improper Neutralization of Special Elements used in a Command
A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.
- 9.8 Critical severity
AOS-CX: Improper Authentication
A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin passwo
- 7.6 High severity
HPE Aruba Networking Wireless Operating System…: Uncontrolled Resource Consumption
A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolatio
- 8.1 High severity
HPE Aruba Networking Wireless Operating System…: Improper Control of Generation of Code
A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remot
- 7.8 High severity
HPE Aruba Networking ClearPass Policy Manager: Improper Privilege Management
A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges
- 8.8 High severity
HPE Aruba Networking Private 5G Core: Improper Access Control
An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administ
- 7.5 High severity
HPE Aruba Networking Fabric Composer: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory.
- 7.2 High severity
HPE Aruba Networking Fabric Composer: Improper Neutralization of Special Elements used in an OS Command
Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying oper
- 9.8 Critical severity
EdgeConnect SD-WAN Orchestrator: Improper Authentication
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary mult
- 7.2 High severity
EdgeConnect SD-WAN Orchestrator: Improper Neutralization of Special Elements used in an SQL Command
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the und
- 7.2 High severity
EdgeConnect SD-WAN Orchestrator: Improper Neutralization of Special Elements used in an SQL Command
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the und
- 7.2 High severity
EdgeConnect SD-WAN Orchestrator: Improper Neutralization of Special Elements used in an SQL Command
Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the und
- 7.8 High severity
Virtual Intranet Access (VIA): Improper Privilege Management
A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges
- 7.5 High severity
ArubaOS (AOS): Out-of-bounds Read
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation of maximum buffer size values, the process may attempt to read beyond the intended memory region. Un
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor t
- 7.2 High severity
ArubaOS (AOS): Unrestricted Upload of File with Dangerous Type
Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files as a privil
- 7.2 High severity
ArubaOS (AOS): Insecure Inherited Permissions
Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbi
- 7.2 High severity
An improper input handling vulnerability exists in the web-based management interface of…
An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor with valid credentials to trigge