Hewlett Packard Enterprise (HPE) has 260 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 251 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 156. The median CVSS is 7.5 (high), with 61 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-121 (13) and CWE-77 (11). Most affected products: ArubaOS (AOS) (72), Fabric Composer (46), ClearPass Policy Manager (CPPM) (33).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 251 prev 0
Weakness classes
Products
- ArubaOS (AOS) 72
- Fabric Composer 46
- ClearPass Policy Manager (CPPM) 33
- Instant ON 18
- arubaos-cx 16
- AOS-Switch (AOS-S) 9
Worst active — by depth score
CVE-2026-23813Critical· 9.8A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls66CVE-2026-79851Critical· 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-1055CVE-2026-79850Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-855CVE-2026-79849Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-855CVE-2026-79848Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-855
Hewlett Packard Enterprise vulnerabilities
CVEs affecting Hewlett Packard Enterprise, newest first. Open any entry for full detail, references, and exploit status.
260 CVEsRSS
CVE-2026-76749Medium· 6.5A sensitive information disclosure vulnerability exists in AOS-S
A sensitive information disclosure vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated remote attacker to access sensitive information.
CVE-2026-76747Critical· 9.1Buffer overflow vulnerabilities exist in the affected interface of AOS-S
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device.
CVE-2026-76746Critical· 9.3An unauthenticated buffer overflow vulnerability exists in AOS-S
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.
CVE-2026-76752Critical· 9.8Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authenti…
CVE-2026-76751Critical· 9.8A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager
A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the e…
CVE-2026-76750Critical· 9.8Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected sys…
CVE-2026-76748High· 8.8A privilege escalation vulnerability exists in the API of AOS-S
A privilege escalation vulnerability exists in the API of AOS-S. Successful exploitation could allow an authenticated read-only user to escalate their privileges and gain administrative access to the affected system.
CVE-2026-76754Critical· 9.8A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an at…
CVE-2026-76753Critical· 9.8A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execut…
CVE-2026-79797High· 8.8An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources
An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an un…
CVE-2026-79796Critical· 9.8Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allo…
CVE-2026-79794Critical· 9.1A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful explo…
CVE-2026-79802High· 8.8A command injection vulnerability exists in the client software of ClearPass Policy Manager
A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with …
CVE-2026-79799High· 8.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A suc…
CVE-2026-79798Critical· 9.9SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Su…
CVE-2026-79814Medium· 6.7An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met
An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met. Succ…
CVE-2026-79803High· 8.8A command injection vulnerability exists in the API of ClearPass Policy Manager
A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileges and gain administrative control of the affected system.
CVE-2026-79801Critical· 9.8A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code
A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an att…
CVE-2026-79807High· 7.8A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges
A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges. A successful exploit could allow these users to …
CVE-2026-79806High· 7.8A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges
A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit allows a malicious user to escalate to root p…
CVE-2026-79805Critical· 9.8An authenticated path traversal vulnerability exists in ClearPass Policy Manager
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
CVE-2026-79810High· 7.2Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code
Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code. Successful exploitation co…
CVE-2026-79809High· 7.3An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager
An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be as…
CVE-2026-79808High· 7.8A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager
A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitrary code with elevated privileges on the affected host or to disrup…
CVE-2026-79813Medium· 6.7A local privilege escalation vulnerability exists in the ClearPass client software
A local privilege escalation vulnerability exists in the ClearPass client software. Successful exploitation could allow a low-privileged local user to execute commands with elevated privileges on the affected system, if certain condition…
CVE-2026-79812Medium· 6.1A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager
A denial of service vulnerability exists in the OnGuard agent of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an authenticated local attacker to interrupt the normal operation of the agent service.
CVE-2026-79811High· 7.2A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance
A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful ex…
CVE-2026-79817Medium· 5.5A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager
A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker with local access to the affected system to obtain sensitive infor…
CVE-2026-79816Medium· 6.3A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface
A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface. Suc…
CVE-2026-79815Medium· 6.5A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands
A command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands. Successful exploitation could allow an attacker to execute commands with elevat…