Hewlett Packard Enterprise (HPE)
459 CVEs across 82 Hewlett Packard Enterprise (HPE) products. Browse Hewlett Packard Enterprise (HPE) vulnerabilities, severities, and proof-of-concept exploits.
Hewlett Packard Enterprise (HPE) products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63457 | Medium | 6.5 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. |
CVE-2026-63456 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2026-63455 | Critical | 9.8 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentic… |
CVE-2026-44879 | High | 7.2 | 2026-07-21 | A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on ce… |
CVE-2026-44878 | High | 7.2 | 2026-07-21 | A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's f… |
CVE-2026-63454 | High | 7.2 | 2026-07-21 | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a u… |
CVE-2026-63453 | High | 7.2 | 2026-07-21 | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privi… |
CVE-2026-44880 | High | 8.8 | 2026-07-21 | A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-p… |
CVE-2026-44877 | Medium | 6.5 | 2026-07-07 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of t… |
CVE-2026-44871 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Succes… |
CVE-2026-44874 | Medium | 4.9 | 2026-05-12 | A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files o… |
CVE-2026-44873 | Medium | 5.4 | 2026-05-12 | A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled… |
CVE-2026-44872 | High | 7.2 | 2026-05-12 | A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an au… |
CVE-2026-44870 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Succes… |
CVE-2026-44869 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44868 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44867 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44866 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44865 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabi… |
CVE-2026-44864 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44863 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44862 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44861 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44860 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44859 | High | 7.2 | 2026-05-12 | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8… |
CVE-2026-44858 | High | 7.2 | 2026-05-12 | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8… |
CVE-2026-44857 | High | 7.2 | 2026-05-12 | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8… |
CVE-2026-44856 | High | 7.2 | 2026-05-12 | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8… |
CVE-2026-44855 | High | 7.2 | 2026-05-12 | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8… |
CVE-2026-44854 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an aut… |
CVE-2026-44853 | High | 7.2 | 2026-05-12 | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an aut… |
CVE-2026-44852 | High | 7.2 | 2026-05-12 | An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download… |
CVE-2026-23827 | High | 7.5 | 2026-05-12 | A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to ac… |
CVE-2026-23826 | High | 7.5 | 2026-05-12 | A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sendi… |
CVE-2026-23825 | High | 7.5 | 2026-05-12 | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities b… |
CVE-2026-23824 | High | 7.5 | 2026-05-12 | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities b… |
CVE-2026-23823 | High | 7.2 | 2026-05-12 | A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Succes… |
CVE-2026-23822 | Medium | 5.3 | 2026-05-12 | A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. S… |
CVE-2026-23821 | High | 7.2 | 2026-05-12 | A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands u… |
CVE-2026-23820 | High | 7.2 | 2026-05-12 | A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system… |
CVE-2026-23819 | High | 8.8 | 2026-05-12 | A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execu… |
CVE-2026-23818 | High | 8.8 | 2026-04-07 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse… |
CVE-2026-23817 | Medium | 6.5 | 2026-03-11 | A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL. |
CVE-2026-23816 | High | 7.2 | 2026-03-11 | A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying o… |
CVE-2026-23815 | High | 7.2 | 2026-03-11 | A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection… |
CVE-2026-23814 | High | 8.8 | 2026-03-11 | A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious command… |
CVE-2026-23813 | Critical | 9.8 | 2026-03-11 | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to ci… |
CVE-2026-23812 | Medium | 4.3 | 2026-03-04 | A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leverag… |
CVE-2026-23811 | Medium | 4.3 | 2026-03-04 | A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic… |
CVE-2026-23810 | Medium | 4.3 | 2026-03-04 | A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (A… |
CVE-2026-23809 | Medium | 5.4 | 2026-03-04 | A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between… |
CVE-2026-23808 | Medium | 5.4 | 2026-03-04 | A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Tem… |
CVE-2026-23601 | Medium | 5.4 | 2026-03-04 | A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmi… |
CVE-2026-23600 | Critical | 9.8 | 2026-03-02 | A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). |
CVE-2026-23599 | High | 7.8 | 2026-02-18 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of thi… |
CVE-2026-23598 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23597 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23596 | Medium | 6.5 | 2026-02-17 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitati… |
CVE-2026-23595 | High | 8.8 | 2026-02-17 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability… |
CVE-2026-23593 | High | 7.5 | 2026-01-27 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some syste… |
CVE-2026-23592 | High | 7.2 | 2026-01-27 | Insecure file operations in HPE Aruba Networking Fabric Composer’s backup functionality could allow authenticated attackers to achieve remote code execution… |
CVE-2025-37185 | Medium | 5.5 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2025-37184 | Critical | 9.8 | 2026-01-14 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Succe… |
CVE-2025-37183 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37182 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37181 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37186 | High | 7.8 | 2026-01-13 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of thi… |
CVE-2025-37179 | Medium | 5.3 | 2026-01-13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation… |
CVE-2025-37178 | Medium | 5.3 | 2026-01-13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation… |
CVE-2025-37177 | Medium | 6.5 | 2026-01-13 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating syst… |
CVE-2025-37176 | Medium | 6.5 | 2026-01-13 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting th… |
CVE-2025-37175 | High | 7.2 | 2026-01-13 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Succe… |
CVE-2025-37174 | High | 7.2 | 2026-01-13 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating s… |
CVE-2025-37173 | High | 7.2 | 2026-01-13 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems… |
CVE-2025-37172 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37171 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37170 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37169 | High | 7.2 | 2026-01-13 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated… |
CVE-2025-37168 | High | 8.2 | 2026-01-13 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation… |
CVE-2025-37166 | High | 7.5 | 2026-01-13 | A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-re… |
CVE-2025-37165 | High | 7.5 | 2026-01-13 | A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A mali… |
CVE-2025-37164 | Critical | 10.0 | 2025-12-16 | A remote code execution issue exists in HPE OneView. |
CVE-2025-37162 | Medium | 6.5 | 2025-11-18 | A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successfu… |
CVE-2025-37161 | High | 7.5 | 2025-11-18 | A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Succes… |
CVE-2025-37163 | High | 7.2 | 2025-11-18 | A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker cou… |
CVE-2025-37160 | Medium | 5.3 | 2025-11-18 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sens… |
CVE-2025-37159 | Medium | 5.8 | 2025-11-18 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active u… |
CVE-2025-37158 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37157 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37156 | Medium | 6.8 | 2025-11-18 | A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker wit… |
CVE-2025-37155 | High | 7.8 | 2025-11-18 | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If s… |
CVE-2025-37148 | Medium | 6.5 | 2025-10-14 | A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service att… |
CVE-2025-37147 | High | 7.1 | 2025-10-14 | A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensu… |
CVE-2025-37146 | High | 7.2 | 2025-10-14 | A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform re… |
CVE-2025-37145 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successf… |
CVE-2025-37144 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successf… |
CVE-2025-37143 | Medium | 4.9 | 2025-10-14 | An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. S… |
CVE-2025-37142 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37141 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37140 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |