# Hewlett Packard Enterprise (HPE) ArubaOS (AOS).

Every CVE that names Hewlett Packard Enterprise (HPE) ArubaOS (AOS) among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise](https://agentprime.io/advisories/CVE-2026-79855.md)
  `CVE-2026-79855` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79854.md)
  `CVE-2026-79854` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79853.md)
  `CVE-2026-79853` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-79852.md)
  `CVE-2026-79852` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79851.md)
  `CVE-2026-79851` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Authentication Bypass Leading to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79850.md)
  `CVE-2026-79850` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79849.md)
  `CVE-2026-79849` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79848.md)
  `CVE-2026-79848` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79847.md)
  `CVE-2026-79847` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Command Injection Vulnerabilities in AOS-8](https://agentprime.io/advisories/CVE-2026-79846.md)
  `CVE-2026-79846` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Authentication Bypass Leading to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79844.md)
  `CVE-2026-79844` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authenticated Command Injection leads to RCE in AOS-10 CLI Command](https://agentprime.io/advisories/CVE-2026-23823.md)
  `CVE-2026-23823` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection
- [Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service](https://agentprime.io/advisories/CVE-2026-23822.md)
  `CVE-2026-23822` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 5.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: Denial of service
- [Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI](https://agentprime.io/advisories/CVE-2026-23821.md)
  `CVE-2026-23821` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection
- [Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI](https://agentprime.io/advisories/CVE-2026-23820.md)
  `CVE-2026-23820` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Command injection
- [Error in SSID Processing allows Stored XSS in Web Management Interface](https://agentprime.io/advisories/CVE-2026-23819.md)
  `CVE-2026-23819` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Cross-site scripting (XSS)
- [Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System](https://agentprime.io/advisories/CVE-2025-37179.md)
  `CVE-2025-37179` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 5.3 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Memory corruption
- [Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System](https://agentprime.io/advisories/CVE-2025-37178.md)
  `CVE-2025-37178` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 5.3 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Memory corruption
- [Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)](https://agentprime.io/advisories/CVE-2025-37177.md)
  `CVE-2025-37177` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Information disclosure
- [Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow](https://agentprime.io/advisories/CVE-2025-37176.md)
  `CVE-2025-37176` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Command injection
- [Authenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37175.md)
  `CVE-2025-37175` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Unrestricted file upload
- [Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37174.md)
  `CVE-2025-37174` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-277
- [Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI)](https://agentprime.io/advisories/CVE-2025-37173.md)
  `CVE-2025-37173` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-20
- [Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37172.md)
  `CVE-2025-37172` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Command injection
- [Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37171.md)
  `CVE-2025-37171` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Command injection
- [Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37170.md)
  `CVE-2025-37170` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Command injection
- [Stack Overflow Vulnerability in AOS-10 Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37169.md)
  `CVE-2025-37169` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Memory corruption
- [Unauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System](https://agentprime.io/advisories/CVE-2025-37168.md)
  `CVE-2025-37168` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 8.2 High · Not analysed yet · Published 13 Jan 2026 · Tags: Information disclosure
- [Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37145.md)
  `CVE-2025-37145` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Path traversal
- [Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37144.md)
  `CVE-2025-37144` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Path traversal
- [Authenticated Arbitrary File Download Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web Interface (Physical Access Required)](https://agentprime.io/advisories/CVE-2025-37143.md)
  `CVE-2025-37143` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37142.md)
  `CVE-2025-37142` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37141.md)
  `CVE-2025-37141` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37140.md)
  `CVE-2025-37140` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot](https://agentprime.io/advisories/CVE-2025-37139.md)
  `CVE-2025-37139` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Denial of service
- [Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required)](https://agentprime.io/advisories/CVE-2025-37138.md)
  `CVE-2025-37138` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.2 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Command injection
- [Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)](https://agentprime.io/advisories/CVE-2025-37137.md)
  `CVE-2025-37137` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)](https://agentprime.io/advisories/CVE-2025-37136.md)
  `CVE-2025-37136` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)](https://agentprime.io/advisories/CVE-2025-37135.md)
  `CVE-2025-37135` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control
- [Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface](https://agentprime.io/advisories/CVE-2025-37134.md)
  `CVE-2025-37134` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2025 · Tags: Command injection
- [Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user acti…](https://agentprime.io/advisories/CVE-2025-37133.md)
  `CVE-2025-37133` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2025 · Tags: Command injection
- [Authenticated Remote Code Execution Vulnerability in AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface via Arbitrary File Write](https://agentprime.io/advisories/CVE-2025-37132.md)
  `CVE-2025-37132` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2025 · Tags: Unrestricted file upload
- [Kernel Panic triggered by Modified Ethernet Frames leads to Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2025-37148.md)
  `CVE-2025-37148` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Denial of service
- [Secure Boot Bypass allows for Compromise of Hardware Root of Trust](https://agentprime.io/advisories/CVE-2025-37147.md)
  `CVE-2025-37147` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2025 · Tags: Authentication bypass
- [Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2025-37146.md)
  `CVE-2025-37146` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2025 · Tags: Command injection

Newest: <https://agentprime.io/advisories/technology/hewlett-packard-enterprise-hpe-arubaos-aos.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=hewlett-packard-enterprise-hpe-arubaos-aos&cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjA1LjI1MDAwMFoiLCJDVkUtMjAyNi03OTg1NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/hewlett-packard-enterprise-hpe-arubaos-aos/?cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjA1LjI1MDAwMFoiLCJDVkUtMjAyNi03OTg1NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.