Hewlett Packard Enterprise vulnerabilities
We track 492 vulnerabilities in Hewlett Packard Enterprise products across 60+ products. 492 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 5, 2026.
Latest Hewlett Packard Enterprise vulnerabilities
- 7.2 High severity
HPE Aruba Networking AirWave Management Platform: Improper Neutralization of Special Elements used in an OS Command
An authenticated Remote Code Execution (RCE) vulnerability exists in the AirWave CLI. Successful exploitation of this vulnerability could allow a remote authenticated threat actor to run arbitrary commands as a privileged user on the underlying host.
- 8.0 High severity
HPE Aruba Networking ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
An authenticated RCE vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands
- 8.8 High severity
HPE Aruba Networking ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary c
- 8.8 High severity
SECOMN64 Driver: Uncontrolled Search Path Element
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. Sound Research has released driver updates to mitigate the potential vulnerabili
- 7.2 High severity
HPE Aruba Networking Access Points, Instant…: Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operatin
- 9.0 Critical severity
HPE Aruba Networking Access Points, Instant…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of t
- 9.8 Critical severity
HPE Aruba Networking Access Points, Instant…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of t
- 9.8 Critical severity
Aruba OS: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of
- 9.8 Critical severity
Aruba OS: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of
- 9.8 Critical severity
Aruba OS: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of
- 7.2 High severity
Aruba OS: Improper Neutralization of Special Elements used in an OS Command
Authenticated command execution vulnerability exist in the ArubaOS command line interface (CLI). Successful exploitation of this vulnerabilities result in the ability to run arbitrary commands as a priviledge user on the underlying operating system.
- 7.2 High severity
Aruba OS: Improper Neutralization of Special Elements used in an OS Command
Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability result in the ability to inject shell commands on the underlying operating system.
- 7.2 High severity
Aruba OS: Improper Limitation of a Pathname to a Restricted Directory
An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to install unsigned packages on the underlying operating system, enabling the threat actor to execute arbitrary code or inst
- 9.8 Critical severity
HPE Aruba Networking InstantOS and Aruba…: Out-of-bounds Write
There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leadin
- 9.8 Critical severity
HPE Aruba Networking InstantOS and Aruba…: Out-of-bounds Write
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to compl
- 9.8 Critical severity
Hpe Aruba Networking InstantOS and Aruba…: Out-of-bounds Write
There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to compl
- 8.8 High severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtai
- 8.8 High severity
HPE Aruba Networking EdgeConnect SD-WAN: Improper Neutralization of Special Elements used in an OS Command
An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on t
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN: Improper Neutralization of Special Elements used in a Command
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the abi
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN: Improper Neutralization of Special Elements used in a Command
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the abi
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN: Improper Neutralization of Special Elements used in a Command
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the abi
- 7.2 High severity
HPE Aruba Networking EdgeConnect SD-WAN: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow
- 9.0 Critical severity
HPE Aruba Networking EdgeConnect SD-WAN…: Improper Neutralization of Input During Web Page Generation
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit al
- 8.8 High severity
HPE Aruba Networking EdgeConnect SD-WAN…: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to
- 7.5 High severity
HPE Athonet Mobile Core: Improper Control of Generation of Code
A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat actor could execute arbitrary commands with the privilege of the underlying container leading to compl
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service
- 7.5 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.
- 8.8 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 8.8 High severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 8.2 High severity
AOS-8 Instant and AOS-10 AP: Deletion of Data Structure Sentinel
There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlyin
- 8.2 High severity
AOS-8 Instant and AOS-10 AP: Deletion of Data Structure Sentinel
There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system,
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211).
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211).
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Improper Neutralization of Special Elements used in an OS Command
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management p
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8
- 9.8 Critical severity
AOS-8 Instant and AOS-10 AP: Stack-based Buffer Overflow
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8