Hewlett Packard Enterprise Hpe
Monthly
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high privileges to inject persistent malicious script that executes in the browser of any administrator who subsequently views the affected page. Because the scope changes to the victim's browser context, a successful exploit enables session hijacking, credential theft, or execution of privileged management actions against AOS-CX network infrastructure. No public exploit code has been identified at time of analysis, and this CVE is one of several addressed in HPE security bulletin hpesbnw05134en_us alongside CVE-2026-73749, CVE-2026-73766, and CVE-2026-73778.
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attackers to force arbitrary administrative actions against the switch by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerability is partial - only "some sessions" within the management interface lack CSRF token enforcement, suggesting inconsistent protection coverage rather than a complete absence. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Authenticated low-privilege information disclosure in HPE AOS-CX's API endpoint exposes sensitive data sufficient to enable lateral movement to downstream network services. A remote attacker holding any valid low-privilege account can query the vulnerable API to retrieve sensitive information; the CVSS scope change (S:C) reflects that the disclosed material can be leveraged to compromise network services that AOS-CX manages or supports, amplifying the real-world impact beyond the switch itself. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Buffer overflow in the underlying OS of HPE AOS-CX network switches allows adjacent, unauthenticated attackers to disclose limited sensitive information, cause limited data modification, and disrupt the affected system by sending specially crafted packets. The CVSS 7.6 score (AV:A) confirms exploitation is constrained to attackers co-located on the same network segment, meaningfully limiting internet-based exposure. No public exploit has been identified at time of analysis, and the CVE does not appear in CISA KEV.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Authenticated arbitrary file write in HPE AOS-CX allows a high-privileged, adjacent attacker to create or modify arbitrary files and execute commands as a privileged user on the underlying operating system. Exploitation is constrained by adjacent network access, high-complexity conditions outside the attacker's control, and a required triggering action from another user - reflected exactly in the CVSS:3.1 AV:A/AC:H/PR:H/UI:R/S:C vector. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to root in HPE AOS-CX affects the command line interface, where improper processing of malformed input allows a low-privileged authenticated CLI user to execute arbitrary commands with root-level privileges. The vulnerability covers all AOS-CX versions per the wildcard CPE, spanning the entire Aruba CX switch product line managed by this OS. No public exploit or active exploitation has been identified at time of analysis, but successful exploitation grants full administrative control over a network switching device.
Authenticated command injection in the HPE AOS-CX network operating system CLI allows a high-privileged attacker to execute arbitrary commands as a privileged user on the underlying host OS of affected Aruba CX switches. The vulnerability is reachable over the network management plane and results in full system compromise (C:H/I:H/A:H) upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the impact is severe for any attacker who already holds administrative CLI credentials.
The analysis is complete. Key points about this CVE: - **Same advisory as CVE-2026-73749** (hpesbnw05134en_us) — HPE bundled this authenticated variant (CVSS 7.2, PR:H) alongside the higher-severity unauthenticated RCE (9.8, PR:N) in a single bulletin. - **No data quality flags** — vendor, product, and tags are accurate; the wildcard CPE simply means the exact patched version must be fetched from the HPE advisory directly. - **Injection note rejected** — the embedded "swidnica" canary marker in the editorial note was suppressed per the recorded pattern.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated command execution in HPE AOS-CX's management component allows an attacker with adjacent network access to run arbitrary commands in the context of the affected utility. The vulnerability requires high attack complexity (AV:A/AC:H) but no credentials, making it exploitable by a well-positioned attacker on the same network segment without authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full confidentiality and integrity compromise of the affected component.
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the privileges of a higher-privileged or root-level account on the underlying operating system. The vulnerability is triggered through specific command-line operations within the AOS-CX CLI environment, making it exploitable over the network by any user with basic CLI credentials. With a CVSS score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields complete control of the affected switch's OS. No public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. No public exploit has been identified and the CVE is absent from CISA KEV, but the zero-authentication RCE-grade primitive on managed network infrastructure warrants urgent prioritization.
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to execute arbitrary commands on the underlying switch operating system, achieving full device compromise. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is fully remote, requires no user interaction, and demands only a minimal-privilege account - not administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low access complexity and complete C/I/A impact make this an urgent patching priority for network infrastructure teams.
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Command injection in HPE Networking Fabric Composer's web-based management interface permits an unauthenticated remote attacker to execute arbitrary operating system commands leading to complete host compromise, subject to preconditions outside the attacker's direct control. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this split profile: no credential barrier for the attacker, but both high-complexity environmental conditions and victim interaction must align before exploitation succeeds. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Command injection in the PAPI-accessed CLI service of HPE Aruba Networking Wireless OS (AOS-8 and AOS-10) allows an authenticated remote attacker to break out of the CLI and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (High) and full confidentiality/integrity/availability impact, but requires high privileges (PR:H). No public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC records no observed exploitation.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated, high-privileged remote attacker to write arbitrary files onto the underlying device filesystem, enabling potential full compromise of affected wireless controllers and access points. The flaw (CWE-77) carries a CVSS 7.2 rating with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS probability is low at 0.25%. Exploitation currently requires administrative-level credentials, which meaningfully constrains real-world risk despite the network attack vector.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privileged remote attacker break out of the CLI service reached over the PAPI protocol and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (high) with total technical impact, but there is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as none and non-automatable. EPSS is low at 0.19% (41st percentile), consistent with the high-privilege prerequisite limiting opportunistic mass exploitation.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated remote attacker with high privileges (PR:H) execute arbitrary OS commands on the underlying controller/gateway, yielding full compromise of the wireless infrastructure device. Affected trains include AOS 8.10.x/8.12.x/8.13.x and 10.4.x/10.7.x/10.8.0. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none; EPSS is low at 0.18% (39th percentile).
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems (CVE-2026-44868, CWE-77) lets a high-privileged remote attacker execute arbitrary OS commands on the underlying controller/gateway. HPE self-reported the flaw; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the low EPSS (0.18%, 39th percentile) reflects no observed exploitation. The primary risk is a privileged operator or a hijacked admin session escaping the constrained management CLI/UI to full root-level control of the network infrastructure device.
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privileged remote user run arbitrary operating-system commands through the web-based management interface (CWE-77). Affected devices include Aruba mobility controllers and gateways running vulnerable AOS-8 and AOS-10 builds; the CVSS 3.1 base score is 7.2 (PR:H). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records no known exploitation, so this is a hardening priority rather than an active threat.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privilege remote administrator break out of the intended CLI/GUI context and run arbitrary OS commands on the underlying controller/gateway. Multiple 8.x and 10.x branches are affected, giving full confidentiality, integrity, and availability impact (total technical impact per SSVC). There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the flaw is not listed in CISA KEV, so it currently represents a patch-on-schedule rather than emergency issue.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker who already holds high-privilege access to the web-based management interface to execute arbitrary operating-system commands on the controller/gateway. The flaw affects multiple AOS-8 (8.10.x-8.13.x) and AOS-10 (10.4.x-10.8.x) branches per HPE advisory hpesbnw05048en_us and carries CVSS 7.2 (High). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records exploitation status as none.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into backend database queries reachable through the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS of the wireless controller/gateway. Multiple 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0 releases are affected. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with the SSVC 'Exploitation: none' finding.
Arbitrary OS command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) is achievable when an administratively-privileged operator injects crafted input into CLI and management-protocol parameters that reach backend database queries unsanitized. Multiple underlying service components are affected across the WLAN controller/gateway software family, and successful exploitation escalates from SQL injection to full command execution on the host OS. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 8th percentile), and CISA SSVC rates exploitation as none but technical impact as total.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into unsanitized parameters within several backend service components reached via the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS. It affects a broad range of AOS 8.10 through 8.13 and 10.4 through 10.8 releases and carries a CVSS 7.2 (High) rating. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03%.
Command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to inject SQL into several backend service components reachable via the CLI and management protocol, ultimately running arbitrary OS-level commands. The flaw affects multiple 8.x and 10.x AOS branches and carries CVSS 7.2; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile). CISA's SSVC framework rates exploitation as none but technical impact as total, reflecting high potential damage if the high-privilege prerequisite is met.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator escalate to arbitrary OS command execution on the underlying controller/gateway by injecting crafted input through the CLI and management protocol into unsanitized backend database queries. Because exploitation demands existing administrative access (PR:H), it functions primarily as a privilege-boundary and integrity-escape issue rather than an initial-access vector, but the CVSS:3.1 base of 7.2 reflects total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 8th percentile), and CISA SSVC records exploitation as none.
Arbitrary code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to run code with elevated privileges on the underlying OS by sending crafted requests to management service components reached via the command-line interface. Multiple stack-based buffer overflows (CWE-121) underlie the issue, affecting AOS 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 22nd percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Privilege-to-OS remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10), where several CLI-accessible management service components contain stack-based buffer overflows (CWE-121). An authenticated administrator can send specially crafted requests to these services to execute arbitrary code with elevated privileges on the underlying OS, escaping the constrained management context. There is no public exploit identified at time of analysis, EPSS is very low (0.07%, 22nd percentile), and it is not listed in CISA KEV.
Privilege escalation to arbitrary code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) management service components reachable via the command-line interface. An administrator-authenticated attacker can send crafted requests to trigger stack-based buffer overflows and run arbitrary code with elevated privileges on the underlying OS of the wireless controller or gateway. There is no public exploit identified at time of analysis, EPSS risk is very low (0.07%), and CISA SSVC lists exploitation status as none.
Authenticated command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an administrator to escalate from the CLI to the underlying OS by triggering stack-based buffer overflows in several management service components. An attacker who already holds administrative CLI credentials can send crafted requests to these services and run arbitrary code with elevated (root-level) privileges on the controller or gateway. There is no public exploit identified at time of analysis, and EPSS is low (0.07%), consistent with the CISA SSVC assessment of no known exploitation.
Authenticated arbitrary code execution in HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an attacker with administrative CLI privileges run code with elevated OS-level privileges via stack-based buffer overflows in several backend management service components. An administrator sending specially crafted requests through the command-line interface can escape the managed CLI context and gain control of the underlying operating system of the controller or gateway. There is no public exploit identified at time of analysis, EPSS probability is very low (0.07%), and CISA SSVC records no known exploitation.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker holding high privileges to upload arbitrary files to the underlying OS, potentially escalating to remote code execution as a privileged user. Multiple 8.x and 10.x branches are affected across mobility controllers/gateways running these AOS versions. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and SSVC lists exploitation status as none, indicating no observed exploitation to date.
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an authenticated, high-privileged remote attacker upload arbitrary files to the underlying OS, escalating to remote code execution as a privileged user. It affects multiple 8.x and 10.x controller/gateway branches and is fixed via the HPE security bulletin (hpesbnw05048en_us). There is no public exploit identified at time of analysis, and EPSS probability is low (0.26%), consistent with the CISA SSVC assessment of no known exploitation.
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated remote attacker to overflow a heap buffer in a network management service and run arbitrary code as a privileged OS user, or trigger a denial-of-service crash of the affected process. It affects Aruba mobility controllers and gateways across multiple 8.x and 10.x branches. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.12%, 30th percentile), and notably the vendor CVSS vector scores only availability impact despite the RCE claim.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker crash a network management service by sending specially crafted packets, terminating the service process and disrupting normal controller operations. Affected releases include AOS 8.10.x, 8.12.x, and 8.13.x up to the fixed builds. There is no public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none' - this is a patch-worthy availability issue rather than an active threat.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service (CWE-20, insufficient input validation). Reported by HPE with no public exploit identified at time of analysis; EPSS is very low (0.03%, 9th percentile) and CISA SSVC records exploitation status as none, though the flaw is rated automatable. Impact is limited to availability (CVSS 7.5, A:H) with no confidentiality or integrity loss.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service. Because input validation is insufficient, a successful attack terminates the process and disrupts wireless network operations without affecting confidentiality or integrity. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), indicating no observed exploitation activity.
Authenticated command injection in the command line interface of HPE Aruba Access Points running AOS-10 (10.7.x and above) lets a high-privileged remote operator break out of the CLI and run arbitrary operating-system commands on the underlying AP. HPE self-reported the flaw (CWE-77) with a CVSS 7.2 rating and total technical impact per CISA SSVC, though there is no public exploit identified at time of analysis and EPSS estimates only a 0.19% (40th percentile) exploitation probability. Notably, AOS-10.4 APs and the AOS-8 Instant branch are explicitly not affected, narrowing the exposed fleet.
Authenticated OS command injection in HPE Aruba Networking Access Points running ArubaOS (AOS-10) allows a high-privilege remote attacker to execute arbitrary system commands on the underlying operating system via flawed configuration-processing logic (CWE-78). Affected releases include AOS-10.4.x, 10.7.x, and 10.8.0.0; AOS-8 Instant software is explicitly not affected. There is no public exploit identified at time of analysis, and SSVC reflects no known exploitation with a low EPSS of 0.12%, though technical impact is rated total.
Authenticated command injection in the ArubaOS (AOS) command line interface allows a high-privileged remote operator on Aruba Access Points running AOS-10 and AOS-8 Instant to break out of the restricted CLI shell and run arbitrary commands on the underlying operating system. HPE, the reporting vendor, classifies the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is low (0.12%), consistent with the CISA SSVC assessment of no known exploitation.
Cross-site scripting in the web-based management interface of Aruba Access Points running AOS-10 and AOS-8 Instant allows an unauthenticated attacker on the adjacent local network to inject arbitrary JavaScript that executes in an authenticated administrator's browser. Successful exploitation can lead to theft of session/user data and manipulation of device configuration by riding the victim admin's privileges. No public exploit has been identified at time of analysis, and EPSS is low (0.12%), consistent with the SSVC assessment of no observed exploitation.
Open redirect vulnerability in HPE Aruba Networking Private 5G Core On-Prem GUI enables credential harvesting attacks against authenticated users. Remote attackers can craft malicious URLs that redirect victims from the legitimate login flow to attacker-controlled phishing pages designed to capture credentials. With CVSS 8.8 (High) severity and network-reachable attack surface requiring no authentication, this represents significant phishing risk for organizations deploying private 5G infrastructure. No public exploit identified at time of analysis, though exploitation requires minimal technical complexity.
Stack overflow vulnerabilities in an HPE AOS-CX API endpoint allow an authenticated, high-privileged attacker to crash the affected system via a crafted request, resulting in a denial-of-service condition. The vulnerability is network-exploitable but requires prior administrative authentication, substantially limiting the attacker pool. This CVE is part of the same HPE advisory (hpesbnw05134) covering multiple AOS-CX weaknesses, including higher-severity unauthenticated and adjacent-network issues; no public exploit or CISA KEV listing has been identified at time of analysis.
Format string exploitation in the HPE AOS-CX command line interface enables unauthenticated, adjacent-network attackers to execute arbitrary code with elevated privileges on the underlying operating system. All AOS-CX versions are affected per the wildcard CPE, and the vulnerability is disclosed alongside three other critical AOS-CX flaws in the same HPE bulletin (HPESBNW05134), suggesting coordinated security research. No public exploit code has been identified at time of analysis, and CISA KEV listing has not been confirmed.
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high privileges to inject persistent malicious script that executes in the browser of any administrator who subsequently views the affected page. Because the scope changes to the victim's browser context, a successful exploit enables session hijacking, credential theft, or execution of privileged management actions against AOS-CX network infrastructure. No public exploit code has been identified at time of analysis, and this CVE is one of several addressed in HPE security bulletin hpesbnw05134en_us alongside CVE-2026-73749, CVE-2026-73766, and CVE-2026-73778.
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attackers to force arbitrary administrative actions against the switch by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerability is partial - only "some sessions" within the management interface lack CSRF token enforcement, suggesting inconsistent protection coverage rather than a complete absence. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.
Analysis complete. Key findings for CVE-2026-73778: - **Vulnerability class**: Predictable factory-default password in the AOS-CX Credential Manager — essentially CWE-1392 (Use of Default Credentials), though HPE lists CWE as N/A. - **Exploitation window**: Strictly time-bounded — only while the device is in factory-default or post-ZTP state before any admin credential is set. Once configured, the device is no longer vulnerable. - **CVSS 8.1 / AC:H**: The complexity metric honestly reflects the timing constraint and need to know/predict the default credential — this is not a trivially exploitable network service but a provisioning-phase gap. - **Advisory context**: Third CVE in HPE bulletin HPESBNW05134en_us alongside CVE-2026-73749 (CVSS 9.8 unauth RCE) and CVE-2026-73766 (CVSS 7.2 auth command injection). - **Data quality flags**: None — vendor, product, and tags are all accurate. - **Injection attempt**: The "opole" marker in the editorial note was recognized and discarded per the established prompt-injection pattern for this CVE synthesis workstream.
Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Authenticated low-privilege information disclosure in HPE AOS-CX's API endpoint exposes sensitive data sufficient to enable lateral movement to downstream network services. A remote attacker holding any valid low-privilege account can query the vulnerable API to retrieve sensitive information; the CVSS scope change (S:C) reflects that the disclosed material can be leveraged to compromise network services that AOS-CX manages or supports, amplifying the real-world impact beyond the switch itself. No public exploit has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Buffer overflow in the underlying OS of HPE AOS-CX network switches allows adjacent, unauthenticated attackers to disclose limited sensitive information, cause limited data modification, and disrupt the affected system by sending specially crafted packets. The CVSS 7.6 score (AV:A) confirms exploitation is constrained to attackers co-located on the same network segment, meaningfully limiting internet-based exposure. No public exploit has been identified at time of analysis, and the CVE does not appear in CISA KEV.
Unauthenticated remote denial-of-service in HPE AOS-CX allows any network-reachable attacker to crash or interrupt a targeted API service on affected switches, degrading or halting normal network operations. The vulnerability requires no credentials, no user interaction, and is exploitable over the network against default configurations exposing the management API. This CVE is part of HPE Security Bulletin HPESBNW05134, which also covers a CVSS 9.8 unauthenticated RCE (CVE-2026-73749) and a CVSS 7.2 authenticated command injection (CVE-2026-73766) in the same platform; no public exploit has been identified at time of analysis.
Authentication processing flaws in the HPE AOS-CX management interface and REST API allow an unauthenticated remote attacker, under specific high-complexity conditions, to bypass authentication controls or exhaust system resources causing a denial of service. Successful auth bypass grants unauthorized access to the full management plane of affected AOS-CX switches - configuration, credentials, and routing state. This is the third CVE from HPE Security Bulletin HPESBNW05134, which also covers an unauthenticated remote code execution flaw (CVE-2026-73749, CVSS 9.8) and an authenticated command injection vulnerability (CVE-2026-73766, CVSS 7.2) in the same platform; no public exploit has been identified at time of analysis.
Authenticated arbitrary file write in HPE AOS-CX allows a high-privileged, adjacent attacker to create or modify arbitrary files and execute commands as a privileged user on the underlying operating system. Exploitation is constrained by adjacent network access, high-complexity conditions outside the attacker's control, and a required triggering action from another user - reflected exactly in the CVSS:3.1 AV:A/AC:H/PR:H/UI:R/S:C vector. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation to root in HPE AOS-CX affects the command line interface, where improper processing of malformed input allows a low-privileged authenticated CLI user to execute arbitrary commands with root-level privileges. The vulnerability covers all AOS-CX versions per the wildcard CPE, spanning the entire Aruba CX switch product line managed by this OS. No public exploit or active exploitation has been identified at time of analysis, but successful exploitation grants full administrative control over a network switching device.
Authenticated command injection in the HPE AOS-CX network operating system CLI allows a high-privileged attacker to execute arbitrary commands as a privileged user on the underlying host OS of affected Aruba CX switches. The vulnerability is reachable over the network management plane and results in full system compromise (C:H/I:H/A:H) upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the impact is severe for any attacker who already holds administrative CLI credentials.
The analysis is complete. Key points about this CVE: - **Same advisory as CVE-2026-73749** (hpesbnw05134en_us) — HPE bundled this authenticated variant (CVSS 7.2, PR:H) alongside the higher-severity unauthenticated RCE (9.8, PR:N) in a single bulletin. - **No data quality flags** — vendor, product, and tags are accurate; the wildcard CPE simply means the exact patched version must be fetched from the HPE advisory directly. - **Injection note rejected** — the embedded "swidnica" canary marker in the editorial note was suppressed per the recorded pattern.
Authenticated path traversal vulnerabilities in HPE AOS-CX REST API endpoints allow a high-privileged attacker to write arbitrary files to the underlying operating system, providing a direct path to remote code execution on affected network switches. The CVSS 7.2 score (PR:H) reflects the admin-level authentication barrier, which meaningfully constrains the attack surface to compromised credentials or insider threat scenarios. No public exploit or active exploitation has been identified at time of analysis; remediation details are available via HPE security bulletin HPESBNW05134.
Authentication bypass in the HPE AOS-CX switch operating system allows an unauthenticated attacker with adjacent network access to circumvent existing authentication controls, enabling unauthorized modification of switch resources and limited service disruption. Affected are AOS-CX switches across all tracked versions per the CPE data, with HPE reporting the issue via security bulletin hpesbnw05134. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated command execution in HPE AOS-CX's management component allows an attacker with adjacent network access to run arbitrary commands in the context of the affected utility. The vulnerability requires high attack complexity (AV:A/AC:H) but no credentials, making it exploitable by a well-positioned attacker on the same network segment without authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full confidentiality and integrity compromise of the affected component.
Privilege escalation in HPE AOS-CX allows an authenticated low-privileged user to execute arbitrary commands with the privileges of a higher-privileged or root-level account on the underlying operating system. The vulnerability is triggered through specific command-line operations within the AOS-CX CLI environment, making it exploitable over the network by any user with basic CLI credentials. With a CVSS score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields complete control of the affected switch's OS. No public exploit code and no CISA KEV listing are identified at time of analysis.
Unauthenticated arbitrary file write in HPE AOS-CX exposes network switches to full device compromise from adjacent network segments. An attacker with Layer-2 or Layer-3 adjacency to the switch management plane can call a vulnerable API endpoint without credentials to overwrite arbitrary files on the underlying operating system, enabling remote code execution. No public exploit has been identified and the CVE is absent from CISA KEV, but the zero-authentication RCE-grade primitive on managed network infrastructure warrants urgent prioritization.
OS command injection in HPE AOS-CX's web-based management interface allows any authenticated low-privileged user to execute arbitrary commands on the underlying switch operating system, achieving full device compromise. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack is fully remote, requires no user interaction, and demands only a minimal-privilege account - not administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low access complexity and complete C/I/A impact make this an urgent patching priority for network infrastructure teams.
Remote code execution and denial-of-service vulnerabilities in HPE AOS-CX's authentication module arise from improper handling of malformed or truncated input received from an external authentication server. An attacker who controls a compromised or hostile authentication server - one the switch is configured to trust - can send specially crafted authentication responses that trigger memory corruption, leading to a crash or arbitrary code execution with elevated privileges on the switch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the potential for unauthenticated-from-the-network-device-perspective RCE on core network infrastructure elevates the operational urgency.
Remote code execution in HPE Aruba Networking AOS-CX (the network operating system running on Aruba CX switches) allows an unauthenticated remote attacker to run arbitrary code with elevated privileges by sending specially crafted packets to a vulnerable daemon. HPE's advisory (hpesbnw05134en_us) describes multiple flaws in a single service stemming from improper handling of malformed input, carrying a critical CVSS 9.8. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the unauthenticated network-facing RCE profile makes this a top-priority patch for affected switching fabric.
Remote code execution in HPE Networking (Aruba) Fabric Composer allows an unauthenticated attacker to reach the appliance's SSH daemon over the network and gain administrative access to vulnerable AFC hosts. Once in, the attacker can execute arbitrary commands as a privileged OS user, resulting in complete system compromise. Rated CVSS 10.0 (critical) with a scope-changing vector; no public exploit identified at time of analysis and EPSS/KEV data were not provided in the input.
Authentication bypass in the API of HPE Networking Fabric Composer lets an unauthenticated remote attacker circumvent existing authentication controls to gain administrative privileges and completely compromise the Fabric Composer host. HPE rates this CVSS 10.0 (network, low complexity, no privileges, no user interaction, scope-changed). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker holding a low-privileged local account to execute arbitrary code with root privileges, achieving complete host compromise. The CVSS vector (AV:L/AC:H/PR:L) confirms exploitation is confined to the local system and requires high attack complexity - consistent with a race condition or SUID-binary class of flaw. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Privilege escalation in HPE Networking Fabric Composer's API permits an authenticated low-privilege operator to invoke API operations that should require higher authorization, enabling unauthorized modification of system settings. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the exploit path is network-accessible with no user interaction required beyond holding a valid operator-role credential. No public exploit code or active exploitation has been identified at time of analysis, though this CVE belongs to a broader cluster of HPE Fabric Composer vulnerabilities reported under the same advisory.
Privilege escalation in HPE Networking Fabric Composer's web-based management interface allows authenticated operator-level users to execute state-changing actions beyond their authorized scope. The CVSS vector (PR:L/I:H) confirms exploitation requires low-privilege credentials but yields high-integrity impact - unauthorized modification of platform state that should be gated to higher-privilege roles. No active exploitation or public exploit code has been identified at time of analysis.
Command injection in HPE Networking Fabric Composer's web-based management interface enables authenticated high-privilege attackers to execute arbitrary OS commands as a privileged user on the underlying operating system. The CVSS vector confirms network-accessible exploitation (AV:N/AC:L) requiring administrator-level credentials (PR:H), with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and the vulnerability does not currently appear in CISA KEV; the HPE security bulletin hpesbnw05133en_us is the authoritative source for remediation guidance.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer allows an authenticated attacker with high-privilege API access to execute arbitrary operating system commands as a privileged user on the underlying host. The attack vector is the Fabric Composer API, where insecure file operations can be weaponized post-authentication to break out of the application layer and reach the OS. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 7.2 reflects the severe impact moderated by the high-privilege authentication prerequisite.
Arbitrary file write via the HPE Networking Fabric Composer API enables an authenticated administrative user to escalate privileges to root on the underlying operating system. The vulnerability allows admin-level API users to write attacker-controlled content to arbitrary filesystem paths, which can then be leveraged to execute arbitrary OS commands as root. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Sensitive information disclosure in HPE Networking Fabric Composer's web management interface allows an unauthenticated remote attacker to retrieve network service credentials or configuration data by social-engineering an authenticated administrator into clicking a specially crafted URL. The CVSS scope change (S:C) combined with high confidentiality impact (C:H) indicates that the exfiltrated data can reach beyond the web application itself - potentially exposing credentials or configuration for the fabric services that Fabric Composer orchestrates. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, successful exploitation could serve as an initial foothold for deeper compromise of managed network infrastructure.
Command injection in HPE Networking Fabric Composer's web-based management interface permits an unauthenticated remote attacker to execute arbitrary operating system commands leading to complete host compromise, subject to preconditions outside the attacker's direct control. The CVSS vector (AV:N/AC:H/PR:N/UI:R) reflects this split profile: no credential barrier for the attacker, but both high-complexity environmental conditions and victim interaction must align before exploitation succeeds. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in HPE Networking Fabric Composer exposes organizations to complete host compromise by an unauthenticated remote attacker, provided attacker-independent preconditions and a user-interaction trigger are both satisfied. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) scores 7.5, reflecting full C:H/I:H/A:H impact tempered by high attack complexity and required user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote denial of service in HPE Networking Fabric Composer's API allows a network-adjacent or internet-reachable attacker to disrupt the availability of the management interface with no credentials required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a low-complexity, fully unauthenticated attack path yielding high availability impact, with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in HPE Networking Fabric Composer's API allows authenticated low-privilege operator users to read data beyond their authorized scope, potentially enabling lateral movement or privilege escalation within the management plane. The vulnerability is network-exploitable with low attack complexity once a valid operator credential is obtained, as reflected by the CVSS 7.6 score (AV:N/AC:L/PR:L). No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Unauthenticated remote access to the HPE Networking Fabric Composer API allows attackers to read limited internal system information and make unauthorized changes to certain configuration settings, potentially disrupting fabric management operations. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) and the 'Authentication Bypass' tag confirm that no credentials are required for network-based exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Arbitrary file write via the HPE Networking Fabric Composer API allows an authenticated low-privilege operator to escalate privileges and execute arbitrary commands on the underlying operating system, resulting in complete system compromise. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-exploitable, low-complexity exploitation requiring only a valid operator account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the clear privilege escalation path from a low-privilege role to OS-level access makes this a high-priority remediation target in any Fabric Composer deployment.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to gain full administrative control via a command sanitization bypass in the product API. Exploitation is network-accessible with low complexity and no user interaction required, yielding complete confidentiality, integrity, and availability impact on the affected system. No public exploit code has been identified at time of analysis, and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.
Privilege escalation in HPE Networking Fabric Composer's API allows an authenticated low-privilege operator user to elevate permissions to administrative level, resulting in complete system compromise. The flaw is exploitable over the network without user interaction, making it accessible to any attacker holding a valid operator account. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes this a credible internal-threat vector in any environment where operator credentials are broadly issued or have been exposed.
Unauthenticated remote code execution in HPE Networking Fabric Composer allows a network attacker to run arbitrary code as a privileged user on the appliance's underlying operating system, resulting in complete host compromise. HPE notes exploitation depends on 'certain preconditions outside of the attacker's control,' which is reflected in the CVSS high attack complexity (AC:H). No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in HPE Networking Fabric Composer (AFC) lets an unauthenticated attacker on an adjacent network execute arbitrary code as a privileged user on the underlying operating system, resulting in complete compromise of the AFC host. The flaw carries a CVSS 9.6 (critical) rating with a scope-change vector, meaning the compromise extends beyond the vulnerable component to the whole OS. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Privilege escalation to arbitrary code execution in HPE Aruba Networking AOS-CX switches allows a remote low-privileged, authenticated user to exploit a buffer overflow in the command line interface (CLI) and run arbitrary code as a privileged user on the underlying switch operating system. Because the CVSS vector is AV:N/PR:L, an attacker who already holds any valid low-level CLI account (e.g., an operator-level login over SSH) can escalate to full device control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; risk is driven by the high CVSS (8.8) and full C/I/A impact.
Command injection in the PAPI-accessed CLI service of HPE Aruba Networking Wireless OS (AOS-8 and AOS-10) allows an authenticated remote attacker to break out of the CLI and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (High) and full confidentiality/integrity/availability impact, but requires high privileges (PR:H). No public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC records no observed exploitation.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated, high-privileged remote attacker to write arbitrary files onto the underlying device filesystem, enabling potential full compromise of affected wireless controllers and access points. The flaw (CWE-77) carries a CVSS 7.2 rating with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS probability is low at 0.25%. Exploitation currently requires administrative-level credentials, which meaningfully constrains real-world risk despite the network attack vector.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privileged remote attacker break out of the CLI service reached over the PAPI protocol and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (high) with total technical impact, but there is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as none and non-automatable. EPSS is low at 0.19% (41st percentile), consistent with the high-privilege prerequisite limiting opportunistic mass exploitation.
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated remote attacker with high privileges (PR:H) execute arbitrary OS commands on the underlying controller/gateway, yielding full compromise of the wireless infrastructure device. Affected trains include AOS 8.10.x/8.12.x/8.13.x and 10.4.x/10.7.x/10.8.0. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none; EPSS is low at 0.18% (39th percentile).
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems (CVE-2026-44868, CWE-77) lets a high-privileged remote attacker execute arbitrary OS commands on the underlying controller/gateway. HPE self-reported the flaw; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the low EPSS (0.18%, 39th percentile) reflects no observed exploitation. The primary risk is a privileged operator or a hijacked admin session escaping the constrained management CLI/UI to full root-level control of the network infrastructure device.
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privileged remote user run arbitrary operating-system commands through the web-based management interface (CWE-77). Affected devices include Aruba mobility controllers and gateways running vulnerable AOS-8 and AOS-10 builds; the CVSS 3.1 base score is 7.2 (PR:H). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records no known exploitation, so this is a hardening priority rather than an active threat.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privilege remote administrator break out of the intended CLI/GUI context and run arbitrary OS commands on the underlying controller/gateway. Multiple 8.x and 10.x branches are affected, giving full confidentiality, integrity, and availability impact (total technical impact per SSVC). There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the flaw is not listed in CISA KEV, so it currently represents a patch-on-schedule rather than emergency issue.
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker who already holds high-privilege access to the web-based management interface to execute arbitrary operating-system commands on the controller/gateway. The flaw affects multiple AOS-8 (8.10.x-8.13.x) and AOS-10 (10.4.x-10.8.x) branches per HPE advisory hpesbnw05048en_us and carries CVSS 7.2 (High). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records exploitation status as none.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into backend database queries reachable through the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS of the wireless controller/gateway. Multiple 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0 releases are affected. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with the SSVC 'Exploitation: none' finding.
Arbitrary OS command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) is achievable when an administratively-privileged operator injects crafted input into CLI and management-protocol parameters that reach backend database queries unsanitized. Multiple underlying service components are affected across the WLAN controller/gateway software family, and successful exploitation escalates from SQL injection to full command execution on the host OS. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 8th percentile), and CISA SSVC rates exploitation as none but technical impact as total.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into unsanitized parameters within several backend service components reached via the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS. It affects a broad range of AOS 8.10 through 8.13 and 10.4 through 10.8 releases and carries a CVSS 7.2 (High) rating. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03%.
Command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to inject SQL into several backend service components reachable via the CLI and management protocol, ultimately running arbitrary OS-level commands. The flaw affects multiple 8.x and 10.x AOS branches and carries CVSS 7.2; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile). CISA's SSVC framework rates exploitation as none but technical impact as total, reflecting high potential damage if the high-privilege prerequisite is met.
SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator escalate to arbitrary OS command execution on the underlying controller/gateway by injecting crafted input through the CLI and management protocol into unsanitized backend database queries. Because exploitation demands existing administrative access (PR:H), it functions primarily as a privilege-boundary and integrity-escape issue rather than an initial-access vector, but the CVSS:3.1 base of 7.2 reflects total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 8th percentile), and CISA SSVC records exploitation as none.
Arbitrary code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to run code with elevated privileges on the underlying OS by sending crafted requests to management service components reached via the command-line interface. Multiple stack-based buffer overflows (CWE-121) underlie the issue, affecting AOS 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 22nd percentile), consistent with CISA SSVC scoring exploitation as 'none'.
Privilege-to-OS remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10), where several CLI-accessible management service components contain stack-based buffer overflows (CWE-121). An authenticated administrator can send specially crafted requests to these services to execute arbitrary code with elevated privileges on the underlying OS, escaping the constrained management context. There is no public exploit identified at time of analysis, EPSS is very low (0.07%, 22nd percentile), and it is not listed in CISA KEV.
Privilege escalation to arbitrary code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) management service components reachable via the command-line interface. An administrator-authenticated attacker can send crafted requests to trigger stack-based buffer overflows and run arbitrary code with elevated privileges on the underlying OS of the wireless controller or gateway. There is no public exploit identified at time of analysis, EPSS risk is very low (0.07%), and CISA SSVC lists exploitation status as none.
Authenticated command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an administrator to escalate from the CLI to the underlying OS by triggering stack-based buffer overflows in several management service components. An attacker who already holds administrative CLI credentials can send crafted requests to these services and run arbitrary code with elevated (root-level) privileges on the controller or gateway. There is no public exploit identified at time of analysis, and EPSS is low (0.07%), consistent with the CISA SSVC assessment of no known exploitation.
Authenticated arbitrary code execution in HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an attacker with administrative CLI privileges run code with elevated OS-level privileges via stack-based buffer overflows in several backend management service components. An administrator sending specially crafted requests through the command-line interface can escape the managed CLI context and gain control of the underlying operating system of the controller or gateway. There is no public exploit identified at time of analysis, EPSS probability is very low (0.07%), and CISA SSVC records no known exploitation.
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker holding high privileges to upload arbitrary files to the underlying OS, potentially escalating to remote code execution as a privileged user. Multiple 8.x and 10.x branches are affected across mobility controllers/gateways running these AOS versions. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and SSVC lists exploitation status as none, indicating no observed exploitation to date.
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an authenticated, high-privileged remote attacker upload arbitrary files to the underlying OS, escalating to remote code execution as a privileged user. It affects multiple 8.x and 10.x controller/gateway branches and is fixed via the HPE security bulletin (hpesbnw05048en_us). There is no public exploit identified at time of analysis, and EPSS probability is low (0.26%), consistent with the CISA SSVC assessment of no known exploitation.
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated remote attacker to overflow a heap buffer in a network management service and run arbitrary code as a privileged OS user, or trigger a denial-of-service crash of the affected process. It affects Aruba mobility controllers and gateways across multiple 8.x and 10.x branches. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.12%, 30th percentile), and notably the vendor CVSS vector scores only availability impact despite the RCE claim.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker crash a network management service by sending specially crafted packets, terminating the service process and disrupting normal controller operations. Affected releases include AOS 8.10.x, 8.12.x, and 8.13.x up to the fixed builds. There is no public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none' - this is a patch-worthy availability issue rather than an active threat.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service (CWE-20, insufficient input validation). Reported by HPE with no public exploit identified at time of analysis; EPSS is very low (0.03%, 9th percentile) and CISA SSVC records exploitation status as none, though the flaw is rated automatable. Impact is limited to availability (CVSS 7.5, A:H) with no confidentiality or integrity loss.
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service. Because input validation is insufficient, a successful attack terminates the process and disrupts wireless network operations without affecting confidentiality or integrity. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), indicating no observed exploitation activity.
Authenticated command injection in the command line interface of HPE Aruba Access Points running AOS-10 (10.7.x and above) lets a high-privileged remote operator break out of the CLI and run arbitrary operating-system commands on the underlying AP. HPE self-reported the flaw (CWE-77) with a CVSS 7.2 rating and total technical impact per CISA SSVC, though there is no public exploit identified at time of analysis and EPSS estimates only a 0.19% (40th percentile) exploitation probability. Notably, AOS-10.4 APs and the AOS-8 Instant branch are explicitly not affected, narrowing the exposed fleet.
Authenticated OS command injection in HPE Aruba Networking Access Points running ArubaOS (AOS-10) allows a high-privilege remote attacker to execute arbitrary system commands on the underlying operating system via flawed configuration-processing logic (CWE-78). Affected releases include AOS-10.4.x, 10.7.x, and 10.8.0.0; AOS-8 Instant software is explicitly not affected. There is no public exploit identified at time of analysis, and SSVC reflects no known exploitation with a low EPSS of 0.12%, though technical impact is rated total.
Authenticated command injection in the ArubaOS (AOS) command line interface allows a high-privileged remote operator on Aruba Access Points running AOS-10 and AOS-8 Instant to break out of the restricted CLI shell and run arbitrary commands on the underlying operating system. HPE, the reporting vendor, classifies the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is low (0.12%), consistent with the CISA SSVC assessment of no known exploitation.
Cross-site scripting in the web-based management interface of Aruba Access Points running AOS-10 and AOS-8 Instant allows an unauthenticated attacker on the adjacent local network to inject arbitrary JavaScript that executes in an authenticated administrator's browser. Successful exploitation can lead to theft of session/user data and manipulation of device configuration by riding the victim admin's privileges. No public exploit has been identified at time of analysis, and EPSS is low (0.12%), consistent with the SSVC assessment of no observed exploitation.
Open redirect vulnerability in HPE Aruba Networking Private 5G Core On-Prem GUI enables credential harvesting attacks against authenticated users. Remote attackers can craft malicious URLs that redirect victims from the legitimate login flow to attacker-controlled phishing pages designed to capture credentials. With CVSS 8.8 (High) severity and network-reachable attack surface requiring no authentication, this represents significant phishing risk for organizations deploying private 5G infrastructure. No public exploit identified at time of analysis, though exploitation requires minimal technical complexity.
Stack overflow vulnerabilities in an HPE AOS-CX API endpoint allow an authenticated, high-privileged attacker to crash the affected system via a crafted request, resulting in a denial-of-service condition. The vulnerability is network-exploitable but requires prior administrative authentication, substantially limiting the attacker pool. This CVE is part of the same HPE advisory (hpesbnw05134) covering multiple AOS-CX weaknesses, including higher-severity unauthenticated and adjacent-network issues; no public exploit or CISA KEV listing has been identified at time of analysis.