Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 531

Export CSV
CVE-2026-76681

Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API

A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by EdgeConnect SD-WAN Orchestrator.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76684

Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76669

Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76670

Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76673

Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator

Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76687

Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76688

Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator

Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete compromise of the EdgeConnect SD-WAN Orchestrator host.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76672

Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could result in the disclosure of sensitive third-party API tokens and credentials, potentially enabling lateral movement to external security platforms.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2025-25040

Failure to Properly Enforce Port ACLs on CPU generated packets in CX 9300 Switches

A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aruba Cx 9300 32d \(r8z96a\) Aruba Cx 9300 32d \(r9a29a\) Aruba Cx 9300 32d \(r9a30a\) and 11 more
CVE-2024-54010

Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches

A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to conduct a packet forwarding attack against the ICMP and UDP protocol. For this attack to be successful an attacker requires a switch configuration that allows packets routing (at layer 3). Configurations that do not allow network traffic routing are not impacted. Successful exploitation could allow an attacker to bypass security policies, potentially leading to unauthorized data exposure.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) Aruba Cx 10000-48y6c \(s0f98a\) and 5 more
CVE-2026-73750

Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73753

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73763

Unauthenticated Remote Command Execution in Management Component

A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation could result in remote execution of arbitrary commands in the context of the affected utility.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73778

Credential Manager Vulnerability Allows Unauthorized Administrative Access

A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator has configured credentials by providing a predictable factory-default password. Successful exploitation could result in full administrative control of the affected device during the initial setup process.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73764

Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of affected services.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73762

Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this could enable unauthorized access to management functionality that should be restricted by the configured access control policy.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73761

Unauthenticated Out-of-Bounds Read Vulnerability leads to Information Disclosure in AOS-CX

An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a specially crafted packet. Successful exploitation of this vulnerability results in the ability to disclose sensitive information from the underlying operating system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73760

Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX

An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-73759

Unauthenticated Denial-of-Service Vulnerabilities in AOS-CX

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets. Successful exploitation of these vulnerabilities results in disruption of normal operation on affected devices.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hewlett Packard Enterprise (hpe) Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more