Known vulnerabilities in Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-79865 | A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker… | 9.6 Critical | Oct 22, 2026 |
| CVE-2026-79864 | Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent… | 9.6 Critical | Oct 22, 2026 |
| CVE-2026-79863 | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent… | 9.6 Critical | Oct 22, 2026 |
| CVE-2026-79862 | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent… | 9.6 Critical | Oct 22, 2026 |
| CVE-2026-79861 | There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79860 | Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79859 | Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79858 | An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8 | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79857 | There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79856 | A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79855 | An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79854 | A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79853 | Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79852 | A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct… | 9.8 Critical | Oct 22, 2026 |
| CVE-2026-79851 | Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-79850 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-79849 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-79848 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-79847 | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-79846 | Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-79844 | Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker… | 10.0 Critical | Oct 22, 2026 |
| CVE-2026-23823 | A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote… | 7.2 High | May 12, 2026 |
| CVE-2026-23822 | A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to… | 5.3 Medium | May 12, 2026 |
| CVE-2026-23821 | A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated… | 7.2 High | May 12, 2026 |
| CVE-2026-23820 | A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an… | 7.2 High | May 12, 2026 |
Other Hewlett Packard Enterprise (HPE) products
Fabric Composer 98
Unknown product 71
Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central 51
AOS-CX 46
EdgeConnect SD-WAN Gateways 38
ClearPass Policy Manager (CPPM) 36
Aruba ClearPass Policy Manager 33
HPE Aruba Networking Wireless Operating System (AOS) 27
EdgeConnect SD-WAN Orchestrator 27
Aruba EdgeConnect Enterprise Software 23
Instant On 20
AOS-8 Instant and AOS-10 AP 18