Hewlett Packard Enterprise (HPE) has 132 CVEs on record. Disclosure cadence is accelerating: 132 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 109. The median CVSS is 8.3 (high), with 54 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-269 (7) and CWE-287 (7). Most affected products: ArubaOS (AOS) (71), ClearPass Policy Manager (CPPM) (33), Instant ON (18).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.3
- Publish → KEV
- —
- Last 90 days
- 132 prev 0
Products
- ArubaOS (AOS) 71
- ClearPass Policy Manager (CPPM) 33
- Instant ON 18
- AOS-Switch (AOS-S) 9
- HPE Integrated Lights-Out (iLO) 7 1
Worst active — by depth score
CVE-2026-79851Critical· 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-1055CVE-2026-79850Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-855CVE-2026-79849Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-855CVE-2026-79848Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-855CVE-2026-79847Critical· 10.0Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-1055
Hewlett Packard Enterprise (HPE) vulnerabilities
CVEs affecting Hewlett Packard Enterprise (HPE), newest first. Open any entry for full detail, references, and exploit status.
132 CVEsRSS
CVE-2026-79851Critical· 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the und…
CVE-2026-79850Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attack…
CVE-2026-79849Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary c…
CVE-2026-79848Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary c…
CVE-2026-79847Critical· 10.0Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results…
CVE-2026-79844Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-10
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met.…
CVE-2026-95721Low· 3.3Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface
A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal ope…
CVE-2026-95720Medium· 4.4Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8
A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from reb…
CVE-2026-95719Medium· 4.9Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10
An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attack…
CVE-2026-95718Medium· 5.3Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthori…
CVE-2026-95717Medium· 5.5Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow…
CVE-2026-95715Medium· 6.8Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface
An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying …
CVE-2026-95716Medium· 6.5Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes
An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a v…
CVE-2026-95714Medium· 6.8Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary c…
CVE-2026-95712High· 7.1Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol
A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacke…
CVE-2026-95711High· 7.1Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface
An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if c…
CVE-2026-95713High· 7.0Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface
An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limi…
CVE-2026-95710High· 7.1Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8
An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow…
CVE-2026-95709High· 7.2Authenticated Command Injection Vulnerabilities in AOS-10
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute a…
CVE-2026-95706High· 7.2Authenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with…
CVE-2026-95708High· 7.2Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute a…
CVE-2026-95707High· 7.2Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code a…
CVE-2026-95705High· 7.2Authenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with…
CVE-2026-95704High· 7.2Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary comma…
CVE-2026-79956High· 7.2Improper Sanitization leads to Command Injection in AOS-8 Web Interface
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run …
CVE-2026-79955High· 7.5Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow…
CVE-2026-79895High· 7.5Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10
Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.
CVE-2026-79887High· 8.1Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and po…
CVE-2026-79894High· 7.5Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerability results in the ability to disrupt the availability of the affected interface.
CVE-2026-79893High· 7.5Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10
Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.