Aruba security advisories, May 2026

Every HPE Aruba Networking security advisory published in May 2026, from HPE Aruba Networking Security Advisories (PSIRT) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 18
Critical: 0
High: 15
In CISA KEV: 0
CVEs: 18

Aruba advisories published in May 2026

May 12, 2026
High [CVE-2026-44871] AOS-10: Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems
High7.2
May 12, 2026
High [CVE-2026-44872] AOS-10: command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems
High7.2
May 12, 2026
High [CVE-2026-44870] AOS-10: Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems
High7.2
May 12, 2026
High [CVE-2026-44869] AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems
High7.2
May 12, 2026
High [CVE-2026-44864] AOS-10: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol
High7.2
May 12, 2026
High [CVE-2026-44859] AOS-10: Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems
High7.2
May 12, 2026
High [CVE-2026-44854] AOS-10: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems
High7.2
May 12, 2026
High [CVE-2026-44852] AOS-10: authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface
High7.2
May 12, 2026
High [CVE-2026-23827] AOS-10: heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution
High7.5
May 12, 2026
High [CVE-2026-23826] AOS-8: vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition
High7.5
May 12, 2026
High [CVE-2026-23825] AOS-10: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems
High7.5
May 12, 2026
High [CVE-2026-23823] AOS-10: vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection
High7.2
May 12, 2026
High [CVE-2026-23821] AOS-10: vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions
High7.2
May 12, 2026
High [CVE-2026-23820] AOS-10: vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment
High7.2
May 12, 2026
High [CVE-2026-23819] AOS-10: vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network
High8.8
May 12, 2026
Medium [CVE-2026-44874] AOS-10: vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system
Medium4.9
May 12, 2026
Medium [CVE-2026-44873] AOS-8: session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled
Medium5.4
May 12, 2026
Medium [CVE-2026-23822] AOS-8: vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition
Medium5.3

Get an email when Aruba publishes the next one.

See Aruba's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Aruba

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.