AA
Product
ArubaOS (AOS)
by Hewlett Packard Enterprise (HPE) · last CVE Oct 22, 2026
105
CVEs
0
On KEV
10.0
Max CVSS
71
New 30D
Severity mix
Critical 33High 49Medium 22Low 1
Watch

Add ArubaOS (AOS) to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-79955
7.5
1%
Oct 22
Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-79895
7.5
1%
Oct 22
Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2026-79894
7.5
0%
Oct 22
Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-79893
7.5
1%
Oct 22
Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2025-37178
7.5
0%
Jan 13
Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System
Affected: 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2026-95709
7.2
1%
Oct 22
Authenticated Command Injection Vulnerabilities in AOS-10
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2026-95708
7.2
1%
Oct 22
Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2026-95707
7.2
1%
Oct 22
Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-95706
7.2
1%
Oct 22
Authenticated Command Injection Vulnerabilities in AOS-8
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-95705
7.2
1%
Oct 22
Authenticated Command Injection Vulnerabilities in AOS-8
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-95704
7.2
1%
Oct 22
Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13; 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-79956
7.2
1%
Oct 22
Improper Sanitization leads to Command Injection in AOS-8 Web Interface
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-23823
7.2
1%
May 12
Authenticated Command Injection leads to RCE in AOS-10 CLI Command
Affected: 10.8.0.0; 10.7.0.0 through 10.7.2.2
CVE-2026-23821
7.2
1%
May 12
Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI
Affected: 10.8.0.0; 10.7.0.0 through 10.7.2.2; 10.4.0.0 through 10.4.1.10
CVE-2026-23820
7.2
1%
May 12
Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI
Affected: 10.8.0.0; 10.7.0.0 through 10.7.2.2; 10.4.0.0 through 10.4.1.10; 8.13.0.0 through 8.13.1.1; 8.12.0.0 through 8.12.0.6; 8.10.0.0 through 8.10.0.21
CVE-2025-37176
7.2
1%
Jan 13
Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow
Affected: 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37175
7.2
1%
Jan 13
Authenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface
Affected: 10.6.0.0 through 10.7.2.1; 10.3.0.0 through 10.4.1.9; 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37174
7.2
1%
Jan 13
Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface
Affected: 10.6.0.0 through 10.7.2.1; 10.3.0.0 through 10.4.1.9; 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37173
7.2
0%
Jan 13
Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)
Affected: 10.6.0.0 through 10.7.2.1; 10.3.0.0 through 10.4.1.9; 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37172
7.2
1%
Jan 13
Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
Affected: 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37171
7.2
1%
Jan 13
Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
Affected: 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37170
7.2
1%
Jan 13
Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface
Affected: 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37169
7.2
1%
Jan 13
Stack Overflow Vulnerability in AOS-10 Web-Based Management Interface
Affected: 10.6.0.0 through 10.7.2.1; 10.3.0.0 through 10.4.1.9
CVE-2025-37134
7.2
1%
Oct 14
Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37133
7.2
1%
Oct 14
Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage.
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37132
7.2
1%
Oct 14
Authenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37146
7.2
1%
Oct 14
Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2026-95712
7.1
0%
Oct 22
Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-95711
7.1
0%
Oct 22
Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2026-95710
7.1
0%
Oct 22
Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13; 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2025-37147
7.1
0%
Oct 14
Secure Boot Bypass allows for Compromise of Hardware Root of Trust
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2026-95713
7.0
0%
Oct 22
Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-95715
6.8
2%
Oct 22
Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2026-95714
6.8
0%
Oct 22
Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2026-95716
6.5
0%
Oct 22
Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2025-37177
6.5
0%
Jan 13
Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)
Affected: 10.6.0.0 through 10.7.2.1; 10.3.0.0 through 10.4.1.9; 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2025-37137
6.5
0%
Oct 14
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37136
6.5
0%
Oct 14
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37135
6.5
0%
Oct 14
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37148
6.5
0%
Oct 14
Kernel Panic triggered by Modified Ethernet Frames leads to Denial of Service Vulnerability
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37138
6.2
1%
Oct 14
Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required)
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37139
6.0
0%
Oct 14
Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2026-95717
5.5
0%
Oct 22
Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13; 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-95718
5.3
0%
Oct 22
Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8
Affected: 8.13.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23
CVE-2026-23822
5.3
0%
May 12
Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service
Affected: 8.13.0.0 through 8.13.1.1; 8.12.0.0 through 8.12.0.6; 8.10.0.0 through 8.10.0.21
CVE-2025-37179
5.3
0%
Jan 13
Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System
Affected: 8.12.0.0 through 8.13.1.0; 8.10.0.0 through 8.10.0.20
CVE-2026-95719
4.9
0%
Oct 22
Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10
Affected: 10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13
CVE-2025-37145
4.9
0%
Oct 14
Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37144
4.9
0%
Oct 14
Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
CVE-2025-37143
4.9
0%
Oct 14
Authenticated Arbitrary File Download Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web Interface (Physical Access Required)
Affected: 10.7.0.0 through 10.7.1.1; 10.4.0.0 through 10.4.1.8; 8.13.0.0 through 8.13.0.1; 8.12.0.0 through 8.12.0.5; 8.10.0.0 through 8.10.0.18
Page 2 of 3 · 105 total