4
CVEs
0
Critical
2
High
0
KEV
0
PoC
1
Unpatched C/H
25.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Clearpass Policy Manager
91
Arubaos
77
Scalance W1750D Firmware
46
Instantos
32
Airwave
29
Clearpass
28
Instant
27
Edgeconnect Enterprise
23
Sd Wan
22
Aos Cx
12
Aruba Instant
8
Airwave Glass
8
Fabric Composer
5
Wordpress Plugin
3
Aruba Edgeconnect Enterprise Orchestrator
3
Aruba Virtual Intranet Access
3
Aos Cx Firmware
3
Aruba Hispeed Cache
3
5406R Firmware
2
Open Redirect
2
Cx 6200F Firmware
2
2620 Firmware
2
2615 Firmware
2
Cx 8325 Firmware
2
2915 Firmware
2
2530 Firmware
2
Cx 6400 Firmware
2
Cx 6300 Firmware
2
2540 Firmware
2
3810M Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-23818 | Open redirect vulnerability in HPE Aruba Networking Private 5G Core On-Prem GUI enables credential harvesting attacks against authenticated users. Remote attackers can craft malicious URLs that redirect victims from the legitimate login flow to attacker-controlled phishing pages designed to capture credentials. With CVSS 8.8 (High) severity and network-reachable attack surface requiring no authentication, this represents significant phishing risk for organizations deploying private 5G infrastructure. No public exploit identified at time of analysis, though exploitation requires minimal technical complexity. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-12602 | Local privilege escalation in ArubaSign prior to v4.6.6 stems from overly permissive ACLs applied at installation, granting the 'Everyone' group write access to the main executable and supporting files under C:\Program Files. An unprivileged local user can swap these binaries for malicious payloads that subsequently execute under the privileges of any user (potentially Administrator or SYSTEM) who later launches the application. No public exploit identified at time of analysis and the issue is not on CISA KEV. | HIGH | 8.8 | 0.1% | 44 |
|
| CVE-2026-15889 | Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. No public exploit code and no active exploitation have been identified at time of analysis. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-1924 | Cross-site request forgery in Aruba HiSpeed Cache WordPress plugin up to version 3.0.4 allows unauthenticated attackers to reset all plugin settings to defaults by tricking site administrators into clicking a malicious link, due to missing nonce verification on the ahsc_ajax_reset_options() function. The CVSS score of 4.3 reflects the low-impact integrity violation requiring user interaction, with no known public exploit code or confirmed active exploitation. | MEDIUM | 4.3 | 0.0% | 22 |
No patch
|