Hewlett Packard Enterprise vulnerabilities
We track 492 vulnerabilities in Hewlett Packard Enterprise products across 60+ products. 492 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Hewlett Packard Enterprise vulnerabilities
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in an OS Command
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privilege
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in an OS Command
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privilege
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in an OS Command
Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privilege
- 7.2 High severity
ArubaOS (AOS): Out-of-bounds Write
A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system.
- 9.1 Critical severity
ArubaOS (AOS): Files or Directories Accessible to External Parties
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files
- 7.5 High severity
Instant On: Allocation of Resources Without Limits or Throttling
A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-responsive state, in some cases requiring a hard reset to re-establish services. A malicious actor coul
- 7.5 High severity
Instant On: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor could gain knowledge of internal network configuration details through inspecting impacte
- 9.8 Critical severity
Hewlett Packard Enterprise (HPE) OneView Code Injection Exploited
A remote code execution issue exists in HPE OneView.
- 8.8 High severity
HPE Aruba Networking 100 Series Cellular Bridge: Improper Neutralization of Special Elements used in a Command
A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating syst
- 7.5 High severity
HPE Aruba Networking 100 Series Cellular Bridge: Uncontrolled Resource Consumption
A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without ma
- 7.2 High severity
HPE Aruba Networking Management Software…: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker could exploit this vulnerability to execute arbitrary operating system commands with elevated privileges
- 7.3 High severity
HPE Aruba Networking AOS-CX: Session Fixation
A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the s
- 8.8 High severity
HPE Aruba Networking AOS-CX: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.
- 8.8 High severity
HPE Aruba Networkign AOS-CX: Improper Control of Generation of Code
A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.
- 7.8 High severity
HPE Aruba Networking AOS-CX: Improper Access Control
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain a
- 7.1 High severity
ArubaOS (AOS): Authentication Bypass by Spoofing
A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensure only vendor-signed firmware can execute on the device. An adversary can exploit this vulnerability
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform remote command execution. Successful exploitation could allow an attacker to execute arbitrary commands
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the
- 7.2 High severity
ArubaOS (AOS): Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the
- 7.2 High severity
ArubaOS (AOS): Unrestricted Upload of File with Dangerous Type
An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files a
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN Gateway: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell access. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyi
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN Gateway: Improper Neutralization of Special Elements used in an OS Command
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the abil
- 7.5 High severity
HPE Aruba Networking EdgeConnect SD-WAN Gateway: Improper Access Control
A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall protections, potentially leading to unauthorized traffic being handled improperly
- 8.6 High severity
HPE Aruba Networking EdgeConnect SD-WAN Gateway: Protection Mechanism Failure
A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitation could allow an attacker to route potentially harmful traffic through the internal network, leadin
- 8.8 High severity
HPE Aruba Networking EdgeConnect SD-WAN Gateway: Improper Privilege Management
A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary sy
- 7.1 High severity
HPE Telco Service Orchestrator: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor n
- 9.8 Critical severity
HPE Networking Instant On: Use of Hard-coded Credentials
Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system.
- 7.2 High severity
HPE Networking Instant On: Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying o
- 8.7 High severity
HPE OneView for VMware vCenter: Improper Privilege Management
A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC). This vulnerability could be exploited allowing an attacker with read only privilege to cause Vertical Privilege Escalation (operator can perform admin actions).
- 7.7 High severity
HPE Aruba Networking Private 5G Core: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download p
- 9.8 Critical severity
HPE Performance Cluster Manager (HPCM): Missing Authorization
A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server host.
- 7.2 High severity
HPE Aruba Networking AOS: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a
- 7.2 High severity
HPE Aruba Networking AOS: Unrestricted Upload of File with Dangerous Type
Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execut
- 8.8 High severity
HPE Aruba Networking ClearPass Policy Manager: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary
- 8.1 High severity
HPE Aruba Networking ClearPass Policy Manager: Cleartext Transmission of Sensitive Information
A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unaut
- 8.1 High severity
HPE Aruba Networking ClearPass Policy Manager: Weak Authentication
A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrator
- 7.2 High severity
HPE Aruba Networking AOS: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating sy
- 7.2 High severity
HPE Aruba Networking AOS: Improper Control of Generation of Code
An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system f
- 7.2 High severity
HPE Aruba Networking 501 Wireless Client Bridge: Improper Neutralization of Special Elements used in a Command
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute
- 7.2 High severity
HPE Aruba Networking 501 Wireless Client Bridge: Improper Neutralization of Special Elements used in a Command
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execute