arubanetworks has 80 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 48 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 48. The median CVSS is 7.2 (high), with 10 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-120 (9) and CWE-200 (9). Most affected products: edgeconnect_sd-wan_orchestrator (38), sd-wan (17), arubaos (15).

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 7.2
Publish → KEV: —
Last 90 days: 48 prev 0

Weakness classes

Products

edgeconnect_sd-wan_orchestrator 38
sd-wan 17
arubaos 15
analytics_and_location_engine 10

Follow arubanetworks:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

arubanetworks vulnerabilities

CVEs affecting arubanetworks, newest first. Open any entry for full detail, references, and exploit status.

80 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

arubanetworks vulnerabilities

A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE)

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service

Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information

Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code

Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator

Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's co…

A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information

A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow

Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks

A privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways

A vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges

A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside…

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges

A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input

A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways.

A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed