Hewlett Packard Enterprise (HPE)
Vulnerability activity for Hewlett Packard Enterprise (HPE): what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 40
- Critical (CVSS 9+)
- 18
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 42
- Critical (CVSS 9+)
- 20
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 43
- Critical (CVSS 9+)
- 21
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 3.3LowOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-95721No description provided
- 4.4MediumOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-95720No description provided
- 4.9MediumOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Privilege escalationCVE-2026-95719No description provided
- 5.5MediumOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product XSSCVE-2026-95717No description provided
- 6.5MediumOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Privilege escalationCVE-2026-95716No description provided
- 6.8MediumOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Code / command injectionCVE-2026-95715No description provided
- 6.8MediumOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-95714No description provided
- 7.0HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-95713No description provided
- 7.1HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Information disclosureCVE-2026-95712No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Code / command injectionCVE-2026-95709No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Code / command injectionCVE-2026-95708No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-95707No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Code / command injectionCVE-2026-95706No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Code / command injectionCVE-2026-95705No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Auth bypass / access controlCVE-2026-95704No description provided
- 7.2HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Code / command injectionCVE-2026-79956No description provided
- 7.5HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-79955No description provided
- 7.5HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Denial of serviceCVE-2026-79895No description provided
- 7.5HighOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Denial of serviceCVE-2026-79894No description provided
- 7.5HighOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Memory corruptionCVE-2026-79893No description provided
- 7.8HighOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Memory corruptionCVE-2026-79892No description provided
- 9.6CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Memory corruptionCVE-2026-79862Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Code / command injectionCVE-2026-79861There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Code / command injectionCVE-2026-79860Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Code / command injectionCVE-2026-79859Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) SQL injectionCVE-2026-79858An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Code / command injectionCVE-2026-79857There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Memory corruptionCVE-2026-79856A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Auth bypass / access controlCVE-2026-79855An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) SQL injectionCVE-2026-79854A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) ArubaOS (AOS) Information disclosureCVE-2026-79853Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 9.8CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product SQL injectionCVE-2026-79852A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-79851Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Auth bypass / access controlCVE-2026-79850Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product SQL injectionCVE-2026-79849Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product SQL injectionCVE-2026-79848Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Memory corruptionCVE-2026-79847Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown productCVE-2026-79846Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 10.0CriticalOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown product Auth bypass / access controlCVE-2026-79844Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- 8.8HighOct 22, 2026Hewlett Packard Enterprise (HPE) Unknown productCVE-2026-79877No description provided
- 9.8CriticalAug 4, 2026Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator Auth bypass / access controlCVE-2026-63456Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
- 9.8CriticalAug 4, 2026Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator Auth bypass / access controlCVE-2026-63455Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.
- 10.0CriticalJan 7, 2026Hewlett Packard Enterprise (HPE) OneView Code / command injectionCVE-2025-37164Hewlett Packard Enterprise (HPE) OneView contains a code injection vulnerability that allows a remote unauthenticated user to perform remote code execution.Exploited90% likelyExploit codeMetasploit · NucleiDetection
See every Hewlett Packard Enterprise (HPE) entry on the dashboard.
Top products
- Unknown product27 CVEs in the last year, 8 critical
- ArubaOS (AOS)13 CVEs in the last year, 10 critical
- EdgeConnect SD-WAN Orchestrator2 CVEs in the last year, 2 critical
- OneView1 CVE in the last year, 1 critical, 1 exploited
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.