Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

ArubaOS (AOS) — Vulnerabilities & Security Advisories 34

All 34 CVE vulnerabilities found in ArubaOS (AOS), with AI-generated Chinese analysis, references, and POCs.

This page is a vulnerability aggregation resource for ArubaOS, a network operating system developed by HPE, focusing on Common Weakness Enumerations and associated security flaws. It collects and catalogs known security vulnerabilities affecting ArubaOS devices, covering advisories and reports issued from the initial release of the software through to the most recent updates. Here, you can track a vendor's advisories to stay informed about critical patches and mitigation strategies released by Hewlett Packard Enterprise. The resource allows you to understand a weakness class by providing context on how specific flaws are exploited or manifest within the ArubaOS architecture. Additionally, users can look up a product's vulnerability history to analyze trends in security stability over time. This centralized view helps security administrators and network engineers prioritize remediation efforts by grouping related issues and highlighting the severity of disclosed weaknesses. The data supports risk assessment activities by presenting a comprehensive overview of the attack surface associated with ArubaOS deployments. By aggregating information from various sources, this page aims to reduce the time required to identify potential threats and apply necessary security controls. It serves as a reference for auditing current installations and planning future upgrades to ensure compliance with security best practices. The content is organized to facilitate quick searches and detailed examination of individual vulnerability records.

Vendor: Hewlett Packard Enterprise (HPE)

CVE IDTitleCVSSSeverityPublished
CVE-2026-23823 Authenticated Command Injection leads to RCE in AOS-10 CLI Command 7.2 High2026-05-12
CVE-2026-23822 Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service 5.3 Medium2026-05-12
CVE-2026-23821 Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI 7.2 High2026-05-12
CVE-2026-23820 Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI 7.2 High2026-05-12
CVE-2026-23819 Error in SSID Processing allows Stored XSS in Web Management Interface 8.8 High2026-05-12
CVE-2025-37179 Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System 5.3 Medium2026-01-13
CVE-2025-37178 Out-of-Bounds Read Vulnerabilities Leading to Process Crash in AOS-8 Operating System 5.3 Medium2026-01-13
CVE-2025-37177 Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI) 6.5 Medium2026-01-13
CVE-2025-37176 Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow 6.5 Medium2026-01-13
CVE-2025-37175 Authenticated Arbitrary File Upload Vulnerability in AOS-10 or AOS-8 Web-Based Management Interface 7.2 High2026-01-13
CVE-2025-37174 Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface 7.2 High2026-01-13
CVE-2025-37173 Improper Input Handling Vulnerability in Authenticated Configuration API Endpoint (AOS-10/AOS-8 Web UI) 7.2 High2026-01-13
CVE-2025-37172 Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface 7.2 High2026-01-13
CVE-2025-37171 Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface 7.2 High2026-01-13
CVE-2025-37170 Authenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management Interface 7.2 High2026-01-13
CVE-2025-37169 Stack Overflow Vulnerability in AOS-10 Web-Based Management Interface 7.2 High2026-01-13
CVE-2025-37168 Unauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System 8.2 High2026-01-13
CVE-2025-37145 Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface 4.9 Medium2025-10-14
CVE-2025-37144 Authenticated Arbitrary File Download Vulnerabilities in a Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface 4.9 Medium2025-10-14
CVE-2025-37143 Authenticated Arbitrary File Download Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web Interface (Physical Access Required) 4.9 Medium2025-10-14
CVE-2025-37142 Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface 4.9 Medium2025-10-14
CVE-2025-37141 Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface 4.9 Medium2025-10-14
CVE-2025-37140 Authenticated Arbitrary File Download Vulnerabilities in CLI Binary of AOS-8 Controller/Mobility Conductor Web-Based Management Interface 4.9 Medium2025-10-14
CVE-2025-37139 Vulnerability in AOS firmware allows for Authenticated Local malicious actor to Permanently Disable Boot 6.0 Medium2025-10-14
CVE-2025-37138 Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required) 6.2 Medium2025-10-14
CVE-2025-37137 Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI) 6.5 Medium2025-10-14
CVE-2025-37136 Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI) 6.5 Medium2025-10-14
CVE-2025-37135 Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI) 6.5 Medium2025-10-14
CVE-2025-37134 Authenticated Command Injection Vulnerability in the Low-Level Interface Library Affecting AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface 7.2 High2025-10-14
CVE-2025-37133 Authenticated Command Injection Vulnerability in AOS-8 Controller/Mobility Conductor Web-Based Management Interface via the CLI Binaryalong with accounting controls for tracking and logging user activities and resource usage. 7.2 High2025-10-14

All 34 known CVE vulnerabilities affecting ArubaOS (AOS) with full Chinese analysis, references, and POCs where available.