Hpe
Monthly
Remote code execution in HPE Aruba ClearPass Policy Manager (CPPM) allows an authenticated attacker with high-privilege access to the web-based management interface to execute arbitrary commands on the underlying operating system. The attack is network-reachable with no user interaction required beyond obtaining administrator credentials. No public exploit has been identified at time of analysis, but full system compromise is achievable upon successful exploitation.
OS command injection in the CLI of HPE Aruba Networking AOS-CX switches (CWE-78) lets an authenticated remote attacker with low-privilege credentials run arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only users who hold valid CLI credentials and can reach the switch management interface (SSH or console management plane) are able to trigger the flaw, so restricting management-plane access to a dedicated network sharply reduces exposure. EPSS places exploitation likelihood at roughly 0.12% (31st percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so this is a latent, credentialed post-authentication risk rather than an actively exploited campaign.
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potentially compromising switch integrity and network operations. This high-privilege attack requires valid credentials and direct network access but carries no patch availability, leaving affected deployments at persistent risk.
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.
Auth bypass in HPE Aruba AOS-CX switch web management.
Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumvent access controls and gain full administrative control over the licensing service, per HPE advisory hpesbgn05003en_us. The flaw (CWE-287, improper authentication) carries a maximum CVSS 4.0 base score of 10.0 with high confidentiality, integrity, and availability impact extending to subsequent systems. No public exploit identified at time of analysis, and the EPSS probability is currently low (0.24%).
Unauthenticated attackers can bypass API authentication in Aruba Networking Private 5G Core to create unauthorized administrative accounts, enabling full system compromise. Successful exploitation grants attackers administrative privileges to modify configurations and access sensitive data within affected deployments.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
HPE networking products can disclose limited confidential data to a local, already-authenticated low-privileged user who also completes user interaction, with minor availability impact and no integrity effect. The exact affected product, version range, and triggering feature are not described in the available sources; the HPE security bulletin is the primary reference. No public exploit code or CISA KEV confirmation is available, and the issue is rated low priority for monitoring.
An unauthenticated, network-reachable information disclosure issue affects an HPE networking product documented in HPE security bulletin hpesbnw05162en_us; the CVSS 5.3 score reflects low integrity impact with no confidentiality or availability loss per the vendor's vector. Because no description was published, the specific feature, protocol, or configuration that triggers the flaw is not described in the available sources, and affected version ranges must be read directly from the HPE advisory. No public exploit code or CISA KEV confirmation accompanies this record, and the medium severity plus low impact place it in a this-month remediation window rather than an emergency one.
HPE networking products can expose limited information and permit limited integrity impact to an authenticated high-privilege administrator; the issue is network reachable with low complexity and no user interaction, and the scope-changed flag means impact may extend beyond the initially vulnerable component. The CVSS score is 5.5 (medium), and no public exploit was identified at time of analysis. Exact models and firmware versions are not identified in the provided data, so affected deployments should be confirmed against HPE bulletin hpesbnw05162en_us; this is a routine, scheduled-patch item rather than an emergency.
Unauthenticated attackers positioned on the same adjacent network segment can modify data or configuration on affected HPE networking devices, reflected in a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). No description, CWE, or version range was supplied with this record, so the specific component, product line and trigger must be resolved from the referenced HPE advisory (docId hpesbnw05162en_us). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; the Layer-2 adjacency prerequisite keeps it off the directly internet-reachable attack surface.
Physical access to certain HPE networking devices can be used to read sensitive data and to alter or disrupt the device, with high confidentiality, integrity, and availability impact once an attacker has hands-on access. The CVSS 3.1 score is 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): no credentials or user interaction are required, but the physical-access prerequisite sharply limits exposure to unattended, field-deployed, or physically insecure hardware. The HPE advisory hpesbnw05162en_us is the only reference supplied; no public exploit was identified at time of analysis, and the specific hardware interface or feature abused is not described in the available sources.
HPE networking devices are affected by a moderate-severity flaw (CVSS 6.8) that an attacker on an adjacent network can trigger only after obtaining high administrative privileges; no user interaction is required and attack complexity is low. The supplied score indicates high confidentiality, integrity, and availability impact, although the source tag labels the issue as information disclosure and the affected versions and triggering feature are not identified in the available data. No public exploit identified at time of analysis.
DOM-based cross-site scripting in the client interface of HPE Networking ClearPass Policy Manager lets an unauthenticated remote attacker execute arbitrary script in the browser context of a legitimate interface user, but only if that user is successfully induced to interact with attacker-supplied input (UI:R) - typically by opening a crafted link. The impact is session-scoped to the targeted victim's browser: the published CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), while our independent assessment scores it consistently at moderate severity and adjusts the availability sub-score to None, since the appliance and other users are not directly compromised. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the attack cannot succeed without victim participation, which substantially limits practical risk. This is a moderate-severity, moderate-priority issue rather than a top-tier emergency, and the HPE security bulletin (hpesbnw05158en_us) is the authoritative source for affected builds and fixed releases.
Local privilege escalation in ClearPass OnGuard allows an authenticated local user to write arbitrary files and potentially execute code with elevated privileges, but only when unspecified preconditions outside the attacker's control are met. The vulnerability requires user interaction and is high-complexity (AC:H), limiting practical exploitability to hosts where the OnGuard agent is deployed and those environmental conditions already exist. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is assessed as moderate and defense-in-depth-tier.
Local privilege escalation in the Aruba/HPE ClearPass client software lets a low-privileged local user execute commands with elevated privileges on the affected host, but only when a specific environmental precondition that the vendor describes as being outside the attacker's control is satisfied. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, score 6.7) confirms that exploitation requires an interactive local session with an existing low-privileged account plus user interaction, meaning there is no remote or unauthenticated attack path and the attacker cannot deterministically force the triggering condition. There is no public exploit identified at time of analysis, no CISA KEV listing, and no evidence of active exploitation; the practical risk is moderate and bounded by these prerequisites rather than by remote reachability.
Sensitive information disclosure in AOS-S (HPE Aruba switching platform) could let a remote attacker read confidential data from an affected device's management surface, as documented in HPE advisory hpesbnw05156en_us. The vendor description characterizes the attacker as unauthenticated, while the published CVSS 3.1 vector carries PR:L (some privilege required); our independent assessment resolves the vector to PR:N with a resulting score of 7.5, but that authentication precondition remains genuinely unresolved and materially changes exploitability, so it should be verified against the advisory before risk is finalized. Exploitation is confined to confidentiality (C:H) with no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis, placing this in a moderate, patch-and-segment priority tier.
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attacker who can reach the service to submit specially crafted input to a specific endpoint and retrieve sensitive user data, including password hashes, which can then be cracked or reused to pivot into other systems. No credentials, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so the only practical barrier is network exposure of the ALE API, which is typically an internal Aruba/HPE wireless location-analytics component. HPE rates the flaw 5.3 (MEDIUM) with low confidentiality impact, while our independent assessment raises the confidentiality impact to High on the same vector; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a patch-and-segment issue rather than a confirmed active campaign.
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock out the service and may expose sensitive location/analytics data, with HPE reporting multiple issues bundled under CVE-2026-76716. Per the scored vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, no credentials and no user interaction are required, but the quantified impact is limited to low confidentiality and low availability, so this is a moderate rather than urgent priority. No public exploit code has been identified at time of analysis and there is no CISA KEV listing indicating confirmed active exploitation (CISA KEV); the realistic exposure is confined to internal/management networks where ALE is typically deployed, since it is a specialized Aruba analytics appliance that is rarely Internet-facing.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Unauthenticated remote attackers can query an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator and read security-relevant configuration details and security feature status. The flaw is a CWE-200 information exposure rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with only a low confidentiality impact and no integrity or availability impact), so it does not by itself compromise the platform but hands an adversary reconnaissance material that directly enables follow-on attacks against the managed SD-WAN fabric. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated attackers holding Admin privileges on HPE Networking EdgeConnect SD-WAN Gateways can send a crafted request to an API endpoint and trigger a classic buffer overflow (CWE-120), potentially achieving arbitrary command execution on the appliance's underlying operating system. ENISA EUVD lists affected builds across the 9.4.x, 9.5.x, 9.6.x and 9.7.x release branches, with the HPE advisory as the sole authoritative reference. No public exploit code and no CISA KEV entry were reported at time of analysis, and the vendor's 5.5 CVSS score omits any confidentiality impact despite the description claiming full OS-level command execution.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A buffer overflow in a system service of the underlying operating system on HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated attacker who already sits on an adjacent network segment to crash the affected service, temporarily disrupting SD-WAN and branch network operations. All editions of the 9.4.x (up to 9.4.8.2), 9.5.x (up to 9.5.8.1), 9.6.x (up to 9.6.3.1) and 9.7.0.0 releases are listed as affected by the vendor. The impact is degraded availability rather than confidentiality or code execution, exploitation requires high attack complexity, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
A buffer overflow in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways lets an unauthenticated remote attacker send specially crafted packets to an affected service and corrupt its memory. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, CWE-120), successful exploitation degrades the integrity and availability of the gateway service without exposing confidential data. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and no EPSS score was provided, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
HPE Aruba Networking 5G Core API error handling exposes sensitive information including user accounts, roles, and system configuration to unauthenticated remote attackers. Successful exploitation enables attackers to gather intelligence on internal services and workflows, creating a foundation for further attacks targeting unauthorized access and privilege escalation. A patch is available.
HPE Aruba Networking 5G Core API error handling leaks sensitive information including user accounts, roles, and system configuration to unauthenticated remote attackers. Exposed internal service details can be leveraged to identify attack vectors for privilege escalation and unauthorized access. A patch is available.
Unauthenticated attackers can trigger service restarts through the management API in Aruba Networking Private 5G Core, causing denial of service and disrupting system availability. This network-adjacent vulnerability requires no authentication or user interaction and has a publicly available patch to remediate the issue.
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ArubaOS-CX web management interface session fixation allows an authenticated remote attacker with low-privilege credentials to hijack an active user session when a legitimate user interacts with the interface, potentially viewing or modifying sensitive switch configuration. The CVSS 7.3 flaw requires reachability to the management UI and victim interaction, with no availability impact; EPSS is low at 0.05% and no public exploit was identified at time of analysis. Environments that expose the web UI to multiple administrators and broad networks have the highest practical exposure.
Authenticated remote attackers holding low-privilege management access to HPE Aruba Networking AOS-CX switches can inject arbitrary OS commands through a management-plane function, resulting in remote code execution with high confidentiality, integrity, and availability impact. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a credible mid-to-high priority but not an emergency; EPSS is 0.13% (32nd percentile) and no public exploit code was identified at time of analysis. The main exposure is organizations that allow management access from broad networks or grant operator-level accounts more widely than necessary.
Authenticated command injection in HPE ArubaOS-CX allows a remote attacker who already holds valid management credentials to execute arbitrary OS commands, with potential for full Remote Code Execution on the switch. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the mandatory authenticated access and typical management-network segregation reduce exposure. No public exploit was identified at time of analysis, and EPSS is low at 0.13% (32nd percentile).
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Secure Boot bypass in HPE Access Points (CVE-2025-37147, CVSS 7.1) lets an adversary defeat the hardware root-of-trust verification that normally restricts execution to vendor-signed firmware, allowing modified or custom firmware to run on the device. Successful exploitation yields a full integrity compromise of the access point's software image with no confidentiality or availability impact claimed, and the CVSS vector (AV:L, PR:N, UI:N) combined with the nature of a hardware secure-boot bypass means the realistic prerequisite is local or physical access to the device rather than a remote network foothold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (4th percentile), indicating a low predicted likelihood of near-term exploitation. This is a genuine but access-gated integrity flaw rather than a mass-exploitation priority.
Permanent denial of service in HPE AOS firmware: an attacker who already holds high-privilege administrative access and local access to the device can invoke a vulnerable firmware binary that erases boot-critical information, leaving the system unbootable and recoverable only by replacing the hardware. The flaw is scored CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H (base 6.0), meaning it is not remotely reachable and not exploitable by unauthenticated users - realistic abuse is limited to malicious insiders or attackers who have already fully compromised the device's administrative plane. No public exploit code and no confirmed active exploitation have been identified; EPSS is 0.14% (3rd percentile), consistent with a low-likelihood, access-constrained issue.
CVE-2024-51770 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated remote attackers to access sensitive information over the network. The vulnerability has a CVSS score of 7.5 with high confidentiality impact, enabling attackers to extract confidential data without requiring authentication, special privileges, or user interaction. The network-accessible nature of this information disclosure makes it a significant risk for organizations running vulnerable APLS versions.
CVE-2024-51769 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated network attackers to access sensitive information without requiring user interaction. The vulnerability has a CVSS 3.1 score of 7.5 with a high confidentiality impact (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor), making it a significant risk for organizations relying on APLS for license management across their HPE infrastructure.
CVE-2024-51768 is a remote code execution vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17, stemming from unsafe deserialization in the embedded HSQLDB database library. An authenticated attacker with local network access can execute arbitrary code with the privileges of the APLS service, potentially leading to complete system compromise. The vulnerability has a CVSS score of 8.0 and represents a significant risk to organizations using affected APLS versions, particularly given the authentication requirement is modest (PR:L) and the attack complexity is low.
CVE-2024-51767 is an authentication bypass vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated remote attackers to gain unauthorized access to the application with limited impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.3 (High) with a network-accessible attack vector requiring no privileges or user interaction, making it trivially exploitable. While specific KEV status and EPSS data are not provided in the available intelligence, the authentication bypass nature combined with the low attack complexity indicates this vulnerability likely poses a moderate-to-high real-world risk to unpatched HPE APLS installations.
A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
Command Injection Rce (3Rd) in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Directory Traversal in HPE StoreOnce backup storage software. One of 6 critical CVEs.
A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.
Auth Bypass in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Command Injection Rce (2Nd) in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Command injection remote code execution vulnerability in HPE StoreOnce Software that allows authenticated attackers with high privileges to execute arbitrary commands on affected systems. The vulnerability has a CVSS score of 7.2 (high severity) and requires authenticated access but no user interaction. Given the command injection nature (CWE-77) and network attack vector, this poses significant risk to organizations running vulnerable HPE StoreOnce deployments, particularly if KEV status or active exploitation is confirmed.
Ssrf in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Command Injection Rce in HPE StoreOnce backup storage software. One of 6 critical CVEs.
A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches -. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. Rated low severity (CVSS 3.4), this vulnerability is no authentication required. No vendor patch available.
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote code execution issue exists in HPE OneView. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The vulnerability could be locally exploited to allow escalation of privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allow local disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in HPE Aruba ClearPass Policy Manager (CPPM) allows an authenticated attacker with high-privilege access to the web-based management interface to execute arbitrary commands on the underlying operating system. The attack is network-reachable with no user interaction required beyond obtaining administrator credentials. No public exploit has been identified at time of analysis, but full system compromise is achievable upon successful exploitation.
OS command injection in the CLI of HPE Aruba Networking AOS-CX switches (CWE-78) lets an authenticated remote attacker with low-privilege credentials run arbitrary commands on the underlying operating system, yielding full compromise of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only users who hold valid CLI credentials and can reach the switch management interface (SSH or console management plane) are able to trigger the flaw, so restricting management-plane access to a dedicated network sharply reduces exposure. EPSS places exploitation likelihood at roughly 0.12% (31st percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, so this is a latent, credentialed post-authentication risk rather than an actively exploited campaign.
Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potentially compromising switch integrity and network operations. This high-privilege attack requires valid credentials and direct network access but carries no patch availability, leaving affected deployments at persistent risk.
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.
Auth bypass in HPE Aruba AOS-CX switch web management.
Remote authentication bypass in HPE AutoPass License Server (APLS) allows unauthenticated network attackers to circumvent access controls and gain full administrative control over the licensing service, per HPE advisory hpesbgn05003en_us. The flaw (CWE-287, improper authentication) carries a maximum CVSS 4.0 base score of 10.0 with high confidentiality, integrity, and availability impact extending to subsequent systems. No public exploit identified at time of analysis, and the EPSS probability is currently low (0.24%).
Unauthenticated attackers can bypass API authentication in Aruba Networking Private 5G Core to create unauthorized administrative accounts, enabling full system compromise. Successful exploitation grants attackers administrative privileges to modify configurations and access sensitive data within affected deployments.
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
HPE networking products can disclose limited confidential data to a local, already-authenticated low-privileged user who also completes user interaction, with minor availability impact and no integrity effect. The exact affected product, version range, and triggering feature are not described in the available sources; the HPE security bulletin is the primary reference. No public exploit code or CISA KEV confirmation is available, and the issue is rated low priority for monitoring.
An unauthenticated, network-reachable information disclosure issue affects an HPE networking product documented in HPE security bulletin hpesbnw05162en_us; the CVSS 5.3 score reflects low integrity impact with no confidentiality or availability loss per the vendor's vector. Because no description was published, the specific feature, protocol, or configuration that triggers the flaw is not described in the available sources, and affected version ranges must be read directly from the HPE advisory. No public exploit code or CISA KEV confirmation accompanies this record, and the medium severity plus low impact place it in a this-month remediation window rather than an emergency one.
HPE networking products can expose limited information and permit limited integrity impact to an authenticated high-privilege administrator; the issue is network reachable with low complexity and no user interaction, and the scope-changed flag means impact may extend beyond the initially vulnerable component. The CVSS score is 5.5 (medium), and no public exploit was identified at time of analysis. Exact models and firmware versions are not identified in the provided data, so affected deployments should be confirmed against HPE bulletin hpesbnw05162en_us; this is a routine, scheduled-patch item rather than an emergency.
Unauthenticated attackers positioned on the same adjacent network segment can modify data or configuration on affected HPE networking devices, reflected in a CVSS 3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). No description, CWE, or version range was supplied with this record, so the specific component, product line and trigger must be resolved from the referenced HPE advisory (docId hpesbnw05162en_us). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; the Layer-2 adjacency prerequisite keeps it off the directly internet-reachable attack surface.
Physical access to certain HPE networking devices can be used to read sensitive data and to alter or disrupt the device, with high confidentiality, integrity, and availability impact once an attacker has hands-on access. The CVSS 3.1 score is 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): no credentials or user interaction are required, but the physical-access prerequisite sharply limits exposure to unattended, field-deployed, or physically insecure hardware. The HPE advisory hpesbnw05162en_us is the only reference supplied; no public exploit was identified at time of analysis, and the specific hardware interface or feature abused is not described in the available sources.
HPE networking devices are affected by a moderate-severity flaw (CVSS 6.8) that an attacker on an adjacent network can trigger only after obtaining high administrative privileges; no user interaction is required and attack complexity is low. The supplied score indicates high confidentiality, integrity, and availability impact, although the source tag labels the issue as information disclosure and the affected versions and triggering feature are not identified in the available data. No public exploit identified at time of analysis.
DOM-based cross-site scripting in the client interface of HPE Networking ClearPass Policy Manager lets an unauthenticated remote attacker execute arbitrary script in the browser context of a legitimate interface user, but only if that user is successfully induced to interact with attacker-supplied input (UI:R) - typically by opening a crafted link. The impact is session-scoped to the targeted victim's browser: the published CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), while our independent assessment scores it consistently at moderate severity and adjusts the availability sub-score to None, since the appliance and other users are not directly compromised. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the attack cannot succeed without victim participation, which substantially limits practical risk. This is a moderate-severity, moderate-priority issue rather than a top-tier emergency, and the HPE security bulletin (hpesbnw05158en_us) is the authoritative source for affected builds and fixed releases.
Local privilege escalation in ClearPass OnGuard allows an authenticated local user to write arbitrary files and potentially execute code with elevated privileges, but only when unspecified preconditions outside the attacker's control are met. The vulnerability requires user interaction and is high-complexity (AC:H), limiting practical exploitability to hosts where the OnGuard agent is deployed and those environmental conditions already exist. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue is assessed as moderate and defense-in-depth-tier.
Local privilege escalation in the Aruba/HPE ClearPass client software lets a low-privileged local user execute commands with elevated privileges on the affected host, but only when a specific environmental precondition that the vendor describes as being outside the attacker's control is satisfied. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, score 6.7) confirms that exploitation requires an interactive local session with an existing low-privileged account plus user interaction, meaning there is no remote or unauthenticated attack path and the attacker cannot deterministically force the triggering condition. There is no public exploit identified at time of analysis, no CISA KEV listing, and no evidence of active exploitation; the practical risk is moderate and bounded by these prerequisites rather than by remote reachability.
Sensitive information disclosure in AOS-S (HPE Aruba switching platform) could let a remote attacker read confidential data from an affected device's management surface, as documented in HPE advisory hpesbnw05156en_us. The vendor description characterizes the attacker as unauthenticated, while the published CVSS 3.1 vector carries PR:L (some privilege required); our independent assessment resolves the vector to PR:N with a resulting score of 7.5, but that authentication precondition remains genuinely unresolved and materially changes exploitability, so it should be verified against the advisory before risk is finalized. Exploitation is confined to confidentiality (C:H) with no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis, placing this in a moderate, patch-and-segment priority tier.
Unauthenticated information disclosure in the HPE Aruba Analytics and Location Engine (ALE) API allows any remote attacker who can reach the service to submit specially crafted input to a specific endpoint and retrieve sensitive user data, including password hashes, which can then be cracked or reused to pivot into other systems. No credentials, privileges, or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so the only practical barrier is network exposure of the ALE API, which is typically an internal Aruba/HPE wireless location-analytics component. HPE rates the flaw 5.3 (MEDIUM) with low confidentiality impact, while our independent assessment raises the confidentiality impact to High on the same vector; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a patch-and-segment issue rather than a confirmed active campaign.
Unauthenticated, network-reachable attacks against HPE Aruba Analytics and Location Engine (ALE) can degrade or knock out the service and may expose sensitive location/analytics data, with HPE reporting multiple issues bundled under CVE-2026-76716. Per the scored vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, no credentials and no user interaction are required, but the quantified impact is limited to low confidentiality and low availability, so this is a moderate rather than urgent priority. No public exploit code has been identified at time of analysis and there is no CISA KEV listing indicating confirmed active exploitation (CISA KEV); the realistic exposure is confined to internal/management networks where ALE is typically deployed, since it is a specialized Aruba analytics appliance that is rarely Internet-facing.
Unauthenticated memory disclosure in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker on an adjacent network segment read portions of system memory, exposing internal service details and workflow information. All shipping 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches are affected per the vendor-published version ranges. The CVSS score is only 4.3 (confidentiality-only, adjacent vector) and there is no public exploit code or CISA KEV listing, so this is best treated as a reconnaissance enabler rather than a standalone compromise — its value to an adversary is in chaining it with a separate privilege-escalation or authentication flaw.
Unauthenticated remote attackers can query an API endpoint in HPE Networking EdgeConnect SD-WAN Orchestrator and read security-relevant configuration details and security feature status. The flaw is a CWE-200 information exposure rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, with only a low confidentiality impact and no integrity or availability impact), so it does not by itself compromise the platform but hands an adversary reconnaissance material that directly enables follow-on attacks against the managed SD-WAN fabric. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated attackers holding Admin privileges on HPE Networking EdgeConnect SD-WAN Gateways can send a crafted request to an API endpoint and trigger a classic buffer overflow (CWE-120), potentially achieving arbitrary command execution on the appliance's underlying operating system. ENISA EUVD lists affected builds across the 9.4.x, 9.5.x, 9.6.x and 9.7.x release branches, with the HPE advisory as the sole authoritative reference. No public exploit code and no CISA KEV entry were reported at time of analysis, and the vendor's 5.5 CVSS score omits any confidentiality impact despite the description claiming full OS-level command execution.
Authenticated administrators of the HPE (Aruba) EdgeConnect SD-WAN Orchestrator web management interface can be tricked into running attacker-supplied script in their own browser session, exposing data handled by the management plane. The flaw is a cross-site scripting (CWE-79) issue rated CVSS 5.5 with a scope change (S:C), meaning the injected code runs in the victim's browser context rather than inside the orchestrator process itself. There is no public exploit identified at time of analysis and the issue does not appear on CISA KEV, but exploitation requires an already-authenticated account, so the practical risk depends heavily on how many privileged accounts exist and how well the UI is network-restricted.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
A buffer overflow in a system service of the underlying operating system on HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated attacker who already sits on an adjacent network segment to crash the affected service, temporarily disrupting SD-WAN and branch network operations. All editions of the 9.4.x (up to 9.4.8.2), 9.5.x (up to 9.5.8.1), 9.6.x (up to 9.6.3.1) and 9.7.0.0 releases are listed as affected by the vendor. The impact is degraded availability rather than confidentiality or code execution, exploitation requires high attack complexity, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated command injection in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways (9.4.x, 9.5.x, 9.6.x and 9.7.0.0) lets a remote user who already holds limited access privileges submit specially crafted input that is passed to the underlying operating system, resulting in arbitrary command execution with elevated privileges or a denial-of-service condition on the appliance. The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) frames this as an availability-weighted, post-authentication issue rather than a pre-auth compromise. No CISA KEV listing, EPSS score or public proof-of-concept was supplied, so exploitation status is 'no public exploit identified at time of analysis'.
EdgeConnect SD-WAN Gateways expose sensitive information to any user who can authenticate to the web-based management interface with low privileges, letting them read data that can be reused to reach other network services managed by the gateway. All four supported branches listed by ENISA (9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1, and 9.7.0.0) are affected, per HPE's advisory hpesbnw05135en_us. The flaw is rated 6.5 (network vector, low privileges, no user interaction, confidentiality-only impact); no public exploit code and no CISA KEV listing were identified at time of analysis, so exploitation currently depends on an attacker already holding valid low-privilege credentials and reachability to the management interface.
Unauthenticated denial of service in HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already sits on an adjacent network segment to crash the appliance, with the added consequence that the gateway cannot reboot itself and requires manual intervention to recover. Affected releases span the 9.4, 9.5, 9.6 and 9.7 maintenance trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively) per the ENISA EUVD record. The flaw is rated CVSS 6.5 (AV:A/AC:L/PR:N/UI:N, availability-only impact) and no public exploit code has been identified at time of analysis; there is no CISA KEV listing.
A buffer overflow in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways lets an unauthenticated remote attacker send specially crafted packets to an affected service and corrupt its memory. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, CWE-120), successful exploitation degrades the integrity and availability of the gateway service without exposing confidential data. No CISA KEV listing and no public exploit code were identified in the supplied intelligence, and no EPSS score was provided, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Privilege escalation in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated, already high-privileged remote user exceed their assigned authorization level and execute arbitrary code on the appliance. Four release branches are affected: 9.4.0.0-9.4.8.2, 9.5.0.0-9.5.8.1, 9.6.0.0-9.6.3.1 and 9.7.0.0. The CVSS score of 6.6 understates the operational weight of the flaw because a compromised SD-WAN gateway sits on the control plane of the whole WAN fabric; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS 6.5).
HPE Aruba Networking 5G Core API error handling exposes sensitive information including user accounts, roles, and system configuration to unauthenticated remote attackers. Successful exploitation enables attackers to gather intelligence on internal services and workflows, creating a foundation for further attacks targeting unauthorized access and privilege escalation. A patch is available.
HPE Aruba Networking 5G Core API error handling leaks sensitive information including user accounts, roles, and system configuration to unauthenticated remote attackers. Exposed internal service details can be leveraged to identify attack vectors for privilege escalation and unauthorized access. A patch is available.
Unauthenticated attackers can trigger service restarts through the management API in Aruba Networking Private 5G Core, causing denial of service and disrupting system availability. This network-adjacent vulnerability requires no authentication or user interaction and has a publicly available patch to remediate the issue.
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ArubaOS-CX web management interface session fixation allows an authenticated remote attacker with low-privilege credentials to hijack an active user session when a legitimate user interacts with the interface, potentially viewing or modifying sensitive switch configuration. The CVSS 7.3 flaw requires reachability to the management UI and victim interaction, with no availability impact; EPSS is low at 0.05% and no public exploit was identified at time of analysis. Environments that expose the web UI to multiple administrators and broad networks have the highest practical exposure.
Authenticated remote attackers holding low-privilege management access to HPE Aruba Networking AOS-CX switches can inject arbitrary OS commands through a management-plane function, resulting in remote code execution with high confidentiality, integrity, and availability impact. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a credible mid-to-high priority but not an emergency; EPSS is 0.13% (32nd percentile) and no public exploit code was identified at time of analysis. The main exposure is organizations that allow management access from broad networks or grant operator-level accounts more widely than necessary.
Authenticated command injection in HPE ArubaOS-CX allows a remote attacker who already holds valid management credentials to execute arbitrary OS commands, with potential for full Remote Code Execution on the switch. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the mandatory authenticated access and typical management-network segregation reduce exposure. No public exploit was identified at time of analysis, and EPSS is low at 0.13% (32nd percentile).
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Secure Boot bypass in HPE Access Points (CVE-2025-37147, CVSS 7.1) lets an adversary defeat the hardware root-of-trust verification that normally restricts execution to vendor-signed firmware, allowing modified or custom firmware to run on the device. Successful exploitation yields a full integrity compromise of the access point's software image with no confidentiality or availability impact claimed, and the CVSS vector (AV:L, PR:N, UI:N) combined with the nature of a hardware secure-boot bypass means the realistic prerequisite is local or physical access to the device rather than a remote network foothold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (4th percentile), indicating a low predicted likelihood of near-term exploitation. This is a genuine but access-gated integrity flaw rather than a mass-exploitation priority.
Permanent denial of service in HPE AOS firmware: an attacker who already holds high-privilege administrative access and local access to the device can invoke a vulnerable firmware binary that erases boot-critical information, leaving the system unbootable and recoverable only by replacing the hardware. The flaw is scored CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H (base 6.0), meaning it is not remotely reachable and not exploitable by unauthenticated users - realistic abuse is limited to malicious insiders or attackers who have already fully compromised the device's administrative plane. No public exploit code and no confirmed active exploitation have been identified; EPSS is 0.14% (3rd percentile), consistent with a low-likelihood, access-constrained issue.
CVE-2024-51770 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated remote attackers to access sensitive information over the network. The vulnerability has a CVSS score of 7.5 with high confidentiality impact, enabling attackers to extract confidential data without requiring authentication, special privileges, or user interaction. The network-accessible nature of this information disclosure makes it a significant risk for organizations running vulnerable APLS versions.
CVE-2024-51769 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated network attackers to access sensitive information without requiring user interaction. The vulnerability has a CVSS 3.1 score of 7.5 with a high confidentiality impact (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor), making it a significant risk for organizations relying on APLS for license management across their HPE infrastructure.
CVE-2024-51768 is a remote code execution vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17, stemming from unsafe deserialization in the embedded HSQLDB database library. An authenticated attacker with local network access can execute arbitrary code with the privileges of the APLS service, potentially leading to complete system compromise. The vulnerability has a CVSS score of 8.0 and represents a significant risk to organizations using affected APLS versions, particularly given the authentication requirement is modest (PR:L) and the attack complexity is low.
CVE-2024-51767 is an authentication bypass vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated remote attackers to gain unauthorized access to the application with limited impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.3 (High) with a network-accessible attack vector requiring no privileges or user interaction, making it trivially exploitable. While specific KEV status and EPSS data are not provided in the available intelligence, the authentication bypass nature combined with the low attack complexity indicates this vulnerability likely poses a moderate-to-high real-world risk to unpatched HPE APLS installations.
A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
Command Injection Rce (3Rd) in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Directory Traversal in HPE StoreOnce backup storage software. One of 6 critical CVEs.
A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software.
Auth Bypass in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Command Injection Rce (2Nd) in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Command injection remote code execution vulnerability in HPE StoreOnce Software that allows authenticated attackers with high privileges to execute arbitrary commands on affected systems. The vulnerability has a CVSS score of 7.2 (high severity) and requires authenticated access but no user interaction. Given the command injection nature (CWE-77) and network attack vector, this poses significant risk to organizations running vulnerable HPE StoreOnce deployments, particularly if KEV status or active exploitation is confirmed.
Ssrf in HPE StoreOnce backup storage software. One of 6 critical CVEs.
Command Injection Rce in HPE StoreOnce backup storage software. One of 6 critical CVEs.
A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches -. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. Rated low severity (CVSS 3.4), this vulnerability is no authentication required. No vendor patch available.
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
HPE Cray Parallel Application Launch Service (PALS) is subject to an authentication bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote code execution issue exists in HPE OneView. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A memory corruption vulnerability in ArubaOS-Switch could lead to unauthenticated remote code execution by receiving specially crafted packets. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The vulnerability could be locally exploited to allow escalation of privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentials. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially allow local disclosure of sensitive. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.