HPE
211 CVEs across 729 HPE products. Browse HPE vulnerabilities, severities, and proof-of-concept exploits.
HPE products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63457 | Medium | 6.5 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. |
CVE-2026-63454 | High | 7.2 | 2026-07-21 | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a u… |
CVE-2026-63453 | High | 7.2 | 2026-07-21 | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privi… |
CVE-2026-44880 | High | 8.8 | 2026-07-21 | A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-p… |
CVE-2026-23818 | High | 8.8 | 2026-04-07 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse… |
CVE-2026-23817 | Medium | 6.5 | 2026-03-11 | A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL. |
CVE-2026-23816 | High | 7.2 | 2026-03-11 | A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying o… |
CVE-2026-23815 | High | 7.2 | 2026-03-11 | A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection… |
CVE-2026-23814 | High | 8.8 | 2026-03-11 | A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious command… |
CVE-2026-23813 | Critical | 9.8 | 2026-03-11 | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to ci… |
CVE-2026-23600 | Critical | 9.8 | 2026-03-02 | A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS). |
CVE-2026-23598 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23597 | Medium | 6.5 | 2026-02-17 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive inf… |
CVE-2026-23596 | Medium | 6.5 | 2026-02-17 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitati… |
CVE-2026-23595 | High | 8.8 | 2026-02-17 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability… |
CVE-2025-37164 | Critical | 10.0 | 2025-12-16 | A remote code execution issue exists in HPE OneView. |
CVE-2025-37160 | Medium | 5.3 | 2025-11-18 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sens… |
CVE-2025-37159 | Medium | 5.8 | 2025-11-18 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active u… |
CVE-2025-37158 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37157 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37156 | Medium | 6.8 | 2025-11-18 | A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker wit… |
CVE-2025-37155 | High | 7.8 | 2025-11-18 | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If s… |
CVE-2025-37107 | High | 7.3 | 2025-07-16 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37106 | High | 7.3 | 2025-07-16 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2025-37105 | High | 7.5 | 2025-07-16 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51769 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51768 | High | 8.0 | 2025-07-14 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2024-51767 | High | 7.3 | 2025-07-14 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-37099 | Critical | 9.8 | 2025-07-01 | A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-37098 | High | 7.5 | 2025-07-01 | A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-37097 | High | 7.5 | 2025-07-01 | A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service |
CVE-2025-37096 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37095 | Critical | 9.8 | 2025-06-02 | A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37094 | Medium | 5.5 | 2025-06-02 | A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37092 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37091 | High | 7.2 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37090 | Critical | 9.8 | 2025-06-02 | A server-side request forgery vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37089 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-27086 | High | 8.1 | 2025-04-21 | A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. |
CVE-2024-53676 | Critical | 9.8 | 2024-11-27 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53673 | High | 8.1 | 2024-11-26 | A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-42508 | Medium | 5.5 | 2024-10-18 | This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. |
CVE-2024-22441 | Critical | 9.8 | 2024-06-13 | HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. |
CVE-2023-50272 | High | 7.5 | 2023-12-19 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be r… |
CVE-2023-50271 | High | 7.2 | 2023-12-17 | A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely… |
CVE-2023-30912 | High | 7.2 | 2023-10-25 | A remote code execution issue exists in HPE OneView. |
CVE-2023-30911 | Medium | 6.8 | 2023-10-18 | HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. |
CVE-2023-30910 | Medium | 5.4 | 2023-10-09 | HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. |
CVE-2023-39268 | Medium | 4.5 | 2023-08-29 | A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Successful expl… |
CVE-2023-39267 | Medium | 6.6 | 2023-08-29 | An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Ser… |
CVE-2023-39266 | High | 8.3 | 2023-08-29 | A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) at… |
CVE-2023-3718 | High | 8.8 | 2023-08-01 | An authenticated command injection vulnerability exists in the AOS-CX command line interface. Successful exploitation of this vulnerability results in the abi… |
CVE-2023-30906 | High | 7.5 | 2023-07-18 | The vulnerability could be locally exploited to allow escalation of privilege. |
CVE-2023-30905 | High | 7.8 | 2023-06-16 | The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege. |
CVE-2023-30904 | Medium | 5.5 | 2023-06-16 | A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information. |
CVE-2023-28084 | Medium | 5.5 | 2023-04-25 | HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens |
CVE-2023-28085 | Medium | 5.5 | 2023-04-14 | An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials |
CVE-2023-28083 | High | 8.3 | 2023-03-22 | A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4… |
CVE-2023-1168 | High | 7.2 | 2023-03-22 | An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Successful exploitation of this vulnerability resul… |
CVE-2022-37940 | Medium | 5.3 | 2023-03-22 | Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow ho… |
CVE-2022-37939 | Low | 2.3 | 2023-03-10 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be locally exploited to al… |
CVE-2022-37938 | Critical | 9.8 | 2023-03-01 | Unauthenticated server side request forgery in HPE Serviceguard Manager |
CVE-2022-37937 | Critical | 9.8 | 2023-03-01 | Pre-auth memory corruption in HPE Serviceguard |
CVE-2022-37936 | Critical | 9.8 | 2023-03-01 | Unauthenticated Java deserialization vulnerability in Serviceguard Manager |
CVE-2022-37934 | Medium | 6.8 | 2023-01-05 | A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. The vulnerability could be remotely exploited to allo… |
CVE-2022-37933 | High | 7.3 | 2023-01-05 | A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow loca… |
CVE-2022-37932 | High | 8.8 | 2022-12-12 | A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability co… |
CVE-2022-37930 | Medium | 6.7 | 2022-12-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially al… |
CVE-2022-37929 | Medium | 6.7 | 2022-12-12 | Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. |
CVE-2022-37928 | High | 8.0 | 2022-12-12 | Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary… |
CVE-2022-37927 | Medium | 6.1 | 2022-12-12 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). |
CVE-2021-46846 | Medium | 6.4 | 2022-12-12 | Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. |
CVE-2022-37931 | High | 7.3 | 2022-11-22 | A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security… |
CVE-2022-28640 | High | 8.8 | 2022-09-20 | A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was dis… |
CVE-2022-28639 | High | 8.8 | 2022-09-20 | A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of conf… |
CVE-2022-28638 | High | 7.8 | 2022-09-20 | An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confid… |
CVE-2022-28637 | High | 7.8 | 2022-09-20 | A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and avail… |
CVE-2022-28636 | High | 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Light… |
CVE-2022-28635 | High | 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Light… |
CVE-2022-28634 | Medium | 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged us… |
CVE-2022-28633 | High | 7.3 | 2022-08-12 | A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) fir… |
CVE-2022-28632 | High | 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO… |
CVE-2022-28631 | High | 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO… |
CVE-2022-28630 | High | 7.3 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28629 | High | 7.8 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user… |
CVE-2022-28628 | High | 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28627 | High | 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28626 | Medium | 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged us… |
CVE-2022-28624 | Medium | 4.8 | 2022-07-08 | A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited… |
CVE-2022-28623 | Critical | 9.8 | 2022-07-08 | Security vulnerabilities in HPE IceWall SSO 10.0 certd could be exploited remotely to allow SQL injection or unauthorized data injection. HPE has provided the… |
CVE-2022-28621 | High | 7.5 | 2022-06-28 | A remote disclosure of sensitive information vulnerability was discovered in HPE NonStop DSM/SCM version: T6031H03^ADP. HPE has provided a software update to r… |
CVE-2022-28622 | High | 7.5 | 2022-06-27 | A potential security vulnerability has been identified in HPE StoreOnce Software. The SSH server supports weak key exchange algorithms which could lead to remo… |
CVE-2022-28620 | Critical | 9.8 | 2022-06-24 | A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions… |
CVE-2022-28619 | High | 7.8 | 2022-06-24 | A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could allow local escalati… |
CVE-2022-28618 | Critical | 9.8 | 2022-05-20 | A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble St… |