Advisories · Technology

Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS).

Every CVE that names Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS) among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-44871 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44873 CVE record

CVSS 5.4 Medium

Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Authentication bypass
Not analysed yet 12 May 2026
CVE-2026-44874 CVE record

CVSS 4.9 Medium

Authenticated Arbitrary File Download via AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Broken access control
Not analysed yet 12 May 2026
CVE-2026-44872 CVE record

CVSS 7.2 High

Authenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44870 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44869 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44868 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44867 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44866 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44865 CVE record

CVSS 7.2 High

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44864 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
Not analysed yet 12 May 2026
CVE-2026-44863 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
Not analysed yet 12 May 2026
CVE-2026-44862 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
Not analysed yet 12 May 2026
CVE-2026-44861 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
Not analysed yet 12 May 2026
CVE-2026-44860 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
Not analysed yet 12 May 2026
CVE-2026-44859 CVE record

CVSS 7.2 High

Authenticated Stack-Based Buffer Overflow in PAPI Services
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-44858 CVE record

CVSS 7.2 High

Authenticated Stack-Based Buffer Overflow in PAPI Services
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-44857 CVE record

CVSS 7.2 High

Authenticated Stack-Based Buffer Overflow in PAPI Services
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-44856 CVE record

CVSS 7.2 High

Authenticated Stack-Based Buffer Overflow in PAPI Services
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-44855 CVE record

CVSS 7.2 High

Authenticated Stack-Based Buffer Overflow in PAPI Services
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-44854 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44853 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Command injection
Not analysed yet 12 May 2026
CVE-2026-44852 CVE record

CVSS 7.2 High

Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- CWE-296
Not analysed yet 12 May 2026
CVE-2026-23827 CVE record

CVSS 7.5 High

Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-23826 CVE record

CVSS 7.5 High

Unauthenticated Denial of Service in AOS-8 Network Management Service
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-23825 CVE record

CVSS 7.5 High

Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- CWE-20
Not analysed yet 12 May 2026
CVE-2026-23824 CVE record

CVSS 7.5 High

Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- Denial of service
Not analysed yet 12 May 2026
CVE-2026-23809 CVE record

CVSS 5.4 Medium

MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
- Denial of service
Not analysed yet 4 Mar 2026
CVE-2026-23808 CVE record

CVSS 5.4 Medium

Client Isolation Bypass via GTK Manipulation
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
- Code injection
Not analysed yet 4 Mar 2026
CVE-2026-23601 CVE record

CVSS 5.4 Medium

Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
- Weak cryptography or TLS
Not analysed yet 4 Mar 2026