Hewlett Packard Enterprise has 260 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 251 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 156. The median CVSS is 7.5 (high), with 61 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-121 (13) and CWE-77 (11). Most affected products: ArubaOS (AOS) (72), Fabric Composer (46), ClearPass Policy Manager (CPPM) (33).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 251 prev 0
Weakness classes
Products
- ArubaOS (AOS) 72
- Fabric Composer 46
- ClearPass Policy Manager (CPPM) 33
- Instant ON 18
- arubaos-cx 16
- AOS-Switch (AOS-S) 9
Worst active — by depth score
CVE-2026-23813Critical· 9.8A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls66CVE-2026-79851Critical· 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-1055CVE-2026-79850Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-855CVE-2026-79849Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-855CVE-2026-79848Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-855
Hewlett Packard Enterprise (HPE) vulnerabilities
CVEs affecting Hewlett Packard Enterprise (HPE), newest first. Open any entry for full detail, references, and exploit status.
260 CVEsRSS
CVE-2026-79857Critical· 9.8Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. S…
CVE-2026-79856Critical· 9.8Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrati…
CVE-2026-79853Critical· 9.8Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker…
CVE-2026-79855Critical· 9.8Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges lead…
CVE-2026-79854Critical· 9.8Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary command…
CVE-2026-79852Critical· 9.8Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary c…
CVE-2026-79846Critical· 10.0Unauthenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control ar…
CVE-2026-76739Medium· 4.3HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification
A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.
CVE-2026-76740High· 7.2HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.
CVE-2026-79838High· 7.3A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.
A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.
CVE-2026-79840High· 7.3A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
CVE-2026-79839High· 7.3A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.
A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.
CVE-2026-79841Medium· 5.8A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption.
A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result in memory corruption.
CVE-2026-79843Medium· 6.5A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.
A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.
CVE-2026-79837High· 7.3A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.
A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.
CVE-2026-79834High· 7.4A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.
A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.
CVE-2026-79836Medium· 6.4A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.
A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.
CVE-2026-79835Low· 2.8A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.
A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.
CVE-2026-79833High· 7.5A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.
A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.
CVE-2026-79830Medium· 6.6A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution.
A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution.
CVE-2026-79831Medium· 6.6A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.
A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.
CVE-2026-79832High· 7.6A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.
CVE-2026-79829High· 8.2A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
CVE-2026-79828High· 7.1A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79825High· 7.1A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79824High· 8.0A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.
CVE-2026-79826High· 7.1A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.
CVE-2026-79827High· 7.1A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.
CVE-2026-79823Medium· 4.0HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
CVE-2026-79822High· 7.1A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.
A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.