Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 134

Export CSV
CVE-2026-23820

Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Arubaos
CVE-2026-23813

Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) Aruba Cx 10000-48y6c \(s0f98a\) and 153 more
CVE-2026-23815

Authenticated Command Injection found in AOS-CX Administrative CLI Command

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.

CVSS 3.1 · 7.2 High EPSS 1.0% KEV · Not listed
Vendors
Hpe
Products
Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) Aruba Cx 10000-48y6c \(s0f98a\) and 153 more
CVE-2026-44880

Low-Privilege Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-63453

Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-63454

Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Hpe
Products
Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more
CVE-2026-23819

Error in SSID Processing allows Stored XSS in Web Management Interface

A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Arubaos
CVE-2025-37169

Stack Overflow Vulnerability in AOS-10 Web-Based Management Interface

A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hp Hpe
Products
Arubaos Arubaos Arubaos
CVE-2026-44852

Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface

An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-44866

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-23827

Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service

A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-23826

Unauthenticated Denial of Service in AOS-8 Network Management Service

A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-23824

Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component

Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-23825

Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component

Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-44873

Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-44874

Authenticated Arbitrary File Download via AOS-10 Web-Based Management Interface

A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system information, potentially enabling further attacks against the affected device.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Arubaos
CVE-2026-44865

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos
CVE-2026-44855

Authenticated Stack-Based Buffer Overflow in PAPI Services

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hpe
Products
Arubaos Sd-wan Arubaos