HPE
285 CVEs across 730 HPE products. Browse HPE vulnerabilities, severities, and proof-of-concept exploits.
HPE products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76707 | Medium | 4.3 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents. Successful… |
CVE-2026-76706 | Medium | 5.3 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive inform… |
CVE-2026-76705 | Medium | 5.5 | 2026-09-15 | A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated… |
CVE-2026-76704 | Medium | 5.5 | 2026-09-15 | A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary… |
CVE-2026-76703 | Medium | 5.5 | 2026-09-15 | A buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow an authenticated at… |
CVE-2026-76702 | Medium | 5.8 | 2026-09-15 | A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service… |
CVE-2026-76701 | Medium | 5.9 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive informatio… |
CVE-2026-76700 | Medium | 5.9 | 2026-09-15 | Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. Successful exploitat… |
CVE-2026-76699 | Medium | 6.4 | 2026-09-15 | A buffer overflow vulnerability exists in a system service within the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allo… |
CVE-2026-76698 | Medium | 6.5 | 2026-09-15 | A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker… |
CVE-2026-76697 | Medium | 6.5 | 2026-09-15 | A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privil… |
CVE-2026-76696 | Medium | 6.5 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successfu… |
CVE-2026-76695 | Medium | 6.5 | 2026-09-15 | Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remo… |
CVE-2026-76694 | Medium | 6.6 | 2026-09-15 | A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an… |
CVE-2026-76693 | High | 7.0 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain servi… |
CVE-2026-76692 | High | 7.1 | 2026-09-15 | A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and di… |
CVE-2026-76691 | High | 7.2 | 2026-09-15 | Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated r… |
CVE-2026-76690 | High | 7.2 | 2026-09-15 | A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote… |
CVE-2026-76689 | High | 7.2 | 2026-09-15 | A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote a… |
CVE-2026-76688 | High | 7.5 | 2026-09-15 | Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated r… |
CVE-2026-76687 | High | 7.5 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate pri… |
CVE-2026-76686 | High | 7.5 | 2026-09-15 | A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an unauthenticated… |
CVE-2026-76685 | High | 8.1 | 2026-09-15 | A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenti… |
CVE-2026-76684 | High | 8.1 | 2026-09-15 | Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor… |
CVE-2026-76683 | High | 8.1 | 2026-09-15 | Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to… |
CVE-2026-76682 | High | 8.2 | 2026-09-15 | A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited… |
CVE-2026-76681 | High | 8.5 | 2026-09-15 | A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information… |
CVE-2026-76680 | High | 8.5 | 2026-09-15 | Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request fo… |
CVE-2026-76679 | High | 8.6 | 2026-09-15 | Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks. Successful… |
CVE-2026-76678 | High | 8.8 | 2026-09-15 | A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privile… |
CVE-2026-76677 | High | 8.8 | 2026-09-15 | A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways. Successful exploitation could allow a remote low-privileged authenticate… |
CVE-2026-76676 | High | 8.8 | 2026-09-15 | Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker t… |
CVE-2026-76675 | Critical | 9.1 | 2026-09-15 | A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated rem… |
CVE-2026-76674 | Critical | 9.8 | 2026-09-15 | Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remo… |
CVE-2026-76673 | Critical | 9.8 | 2026-09-15 | Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent e… |
CVE-2026-76672 | Critical | 9.9 | 2026-09-15 | A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with r… |
CVE-2026-76670 | Critical | 9.9 | 2026-09-15 | Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privi… |
CVE-2026-76669 | Critical | 9.9 | 2026-09-15 | Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privi… |
CVE-2026-73783 | Medium | 4.9 | 2026-09-01 | Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-se… |
CVE-2026-73782 | High | 8.8 | 2026-09-01 | A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation… |
CVE-2026-73781 | High | 8.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) att… |
CVE-2026-73780 | High | 8.3 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This… |
CVE-2026-73779 | High | 8.2 | 2026-09-01 | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent exis… |
CVE-2026-73778 | High | 8.1 | 2026-09-01 | A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could expl… |
CVE-2026-73777 | High | 8.1 | 2026-09-01 | Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing… |
CVE-2026-73776 | High | 7.9 | 2026-09-01 | A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious ac… |
CVE-2026-73775 | High | 7.7 | 2026-09-01 | Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exp… |
CVE-2026-73774 | High | 7.6 | 2026-09-01 | A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by s… |
CVE-2026-73773 | High | 7.5 | 2026-09-01 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the abi… |
CVE-2026-73772 | Medium | 6.5 | 2026-09-01 | Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition by sending specially… |
CVE-2026-73771 | High | 7.5 | 2026-09-01 | An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unauthenticated remote… |
CVE-2026-73770 | High | 7.3 | 2026-09-01 | An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific cond… |
CVE-2026-73768 | High | 7.3 | 2026-09-01 | A vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input. Successful exploitation could result… |
CVE-2026-73767 | High | 7.2 | 2026-09-01 | Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the… |
CVE-2026-73766 | High | 7.2 | 2026-09-01 | Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary… |
CVE-2026-73765 | High | 7.2 | 2026-09-01 | Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arb… |
CVE-2026-73764 | High | 7.1 | 2026-09-01 | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent exis… |
CVE-2026-73763 | High | 7.1 | 2026-09-01 | A vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful exploitation c… |
CVE-2026-73762 | Medium | 6.6 | 2026-09-01 | A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing access controls. In some cases this co… |
CVE-2026-73761 | Medium | 6.5 | 2026-09-01 | An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated information disclosure by sending a… |
CVE-2026-73760 | Medium | 6.5 | 2026-09-01 | An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from t… |
CVE-2026-73759 | Medium | 6.5 | 2026-09-01 | Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending specially crafted packets… |
CVE-2026-73758 | Medium | 6.5 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to… |
CVE-2026-73757 | Medium | 6.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) at… |
CVE-2026-73756 | Medium | 5.9 | 2026-09-01 | A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Succ… |
CVE-2026-73755 | Medium | 5.7 | 2026-09-01 | A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, af… |
CVE-2026-73754 | Medium | 5.3 | 2026-09-01 | Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an authenticated user to disrupt the norma… |
CVE-2026-73753 | High | 8.8 | 2026-09-01 | Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on th… |
CVE-2026-73752 | High | 8.8 | 2026-09-01 | An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to… |
CVE-2026-73751 | High | 8.8 | 2026-09-01 | An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the und… |
CVE-2026-73750 | High | 8.8 | 2026-09-01 | Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit the… |
CVE-2026-73749 | Critical | 9.8 | 2026-09-01 | Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploi… |
CVE-2026-63457 | Medium | 6.5 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. |
CVE-2026-63454 | High | 7.2 | 2026-07-21 | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a u… |
CVE-2026-63453 | High | 7.2 | 2026-07-21 | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privi… |
CVE-2026-44880 | High | 8.8 | 2026-07-21 | A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-p… |
CVE-2026-23818 | High | 8.8 | 2026-04-07 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse… |
CVE-2026-23817 | Medium | 6.5 | 2026-03-11 | A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL. |
CVE-2026-23816 | High | 7.2 | 2026-03-11 | A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying o… |
CVE-2026-23815 | High | 7.2 | 2026-03-11 | A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection… |
CVE-2026-23814 | High | 8.8 | 2026-03-11 | A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious command… |
CVE-2026-23813 | Critical | 9.8 | 2026-03-11 | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to ci… |
CVE-2026-23600 | Critical | 9.8 | 2026-03-02 | A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). |
CVE-2026-23598 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23597 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23596 | Medium | 6.5 | 2026-02-17 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitati… |
CVE-2026-23595 | High | 8.8 | 2026-02-17 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability… |
CVE-2025-37164 | Critical | 10.0 | 2025-12-16 | A remote code execution issue exists in HPE OneView. |
CVE-2025-37160 | Medium | 5.3 | 2025-11-18 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sens… |
CVE-2025-37159 | Medium | 5.8 | 2025-11-18 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active u… |
CVE-2025-37158 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37157 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37156 | Medium | 6.8 | 2025-11-18 | A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker wit… |
CVE-2025-37155 | High | 7.8 | 2025-11-18 | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If s… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37106 | High | 7.3 | 2025-07-16 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37105 | High | 7.5 | 2025-07-16 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51768 | High | 8.0 | 2025-07-14 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |