Aruba security advisories, September 2026

Aruba advisories published in September 2026

1. Sep 29, 2026
   Critical [CVE-2026-76725] Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs

   Critical9.6

2. Sep 29, 2026
   Critical [CVE-2026-76724] Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol

   Critical9.6

3. Sep 29, 2026
   Critical [CVE-2026-76723] Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS

   Critical9.6

4. Sep 29, 2026
   Critical [CVE-2026-76722] Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs

   Critical9.8

5. Sep 29, 2026
   Critical [CVE-2026-76721] Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs

   Critical9.8

6. Sep 29, 2026
   High [CVE-2026-76728] Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs

   High7.2

7. Sep 29, 2026
   High [CVE-2026-76727] Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

   High7.2

8. Sep 29, 2026
   High [CVE-2026-76726] Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint

   High8.1

9. Sep 29, 2026
   Medium [CVE-2026-76735] Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On

   Medium4.1

10. Sep 29, 2026
    Medium [CVE-2026-76734] Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in HPE Networking Instant On

    Medium4.8

11. Sep 29, 2026
    Medium [CVE-2026-76733] Authenticated Denial-of-Service Vulnerability in HPE Networking Instant On API Endpoint

    Medium4.9

12. Sep 29, 2026
    Medium [CVE-2026-76732] Authenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Instant ON

    Medium6.4

13. Sep 29, 2026
    Medium [CVE-2026-76731] Authentication Bypass in the Captive Portal of HPE Networking Instant On

    Medium6.5

14. Sep 29, 2026
    Medium [CVE-2026-76730] Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs

    Medium6.5

15. Sep 29, 2026
    Medium [CVE-2026-76729] Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint

    Medium6.6

16. Sep 29, 2026
    Low [CVE-2026-76738] Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service

    Low2.7

17. Sep 29, 2026
    Low [CVE-2026-76737] Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On

    Low3.0

18. Sep 29, 2026
    Low [CVE-2026-76736] Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On

    Low3.3

19. Sep 15, 2026
    Critical [CVE-2026-76675] EdgeConnect: command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways

    Critical9.1

20. Sep 15, 2026
    Critical [CVE-2026-76674] EdgeConnect: Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code

    Critical9.8

21. Sep 15, 2026
    Critical [CVE-2026-76673] EdgeConnect: Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

    Critical9.8

22. Sep 15, 2026
    Critical [CVE-2026-76672] Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator

    Critical9.9

23. Sep 15, 2026
    Critical [CVE-2026-76670] EdgeConnect: Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator

    Critical9.9

24. Sep 15, 2026
    High [CVE-2026-76693] EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways

    High7.0

25. Sep 15, 2026
    High [CVE-2026-76692] EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal operation of the affected service

    High7.1

26. Sep 15, 2026
    High [CVE-2026-76691] EdgeConnect: Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways

    High7.2

27. Sep 15, 2026
    High [CVE-2026-76690] EdgeConnect: vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution

    High7.2

28. Sep 15, 2026
    High [CVE-2026-76689] Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

    High7.2

29. Sep 15, 2026
    High [CVE-2026-76688] EdgeConnect: Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

    High7.5

30. Sep 15, 2026
    High [CVE-2026-76687] EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges

    High7.5

31. Sep 15, 2026
    High [CVE-2026-76686] EdgeConnect: vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways

    High7.5

32. Sep 15, 2026
    High [CVE-2026-76685] Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

    High8.1

33. Sep 15, 2026
    High [CVE-2026-76684] EdgeConnect: Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

    High8.1

34. Sep 15, 2026
    High [CVE-2026-76683] EdgeConnect: Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met

    High8.1

35. Sep 15, 2026
    High [CVE-2026-76682] Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

    High8.2

36. Sep 15, 2026
    High [CVE-2026-76681] EdgeConnect: vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level

    High8.5

37. Sep 15, 2026
    High [CVE-2026-76680] EdgeConnect: Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks

    High8.5

38. Sep 15, 2026
    High [CVE-2026-76679] EdgeConnect: Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks

    High8.6

39. Sep 15, 2026
    High [CVE-2026-76678] EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges

    High8.8

40. Sep 15, 2026
    High [CVE-2026-76677] EdgeConnect: privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways

    High8.8

41. Sep 15, 2026
    High [CVE-2026-76676] EdgeConnect: Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met

    High8.8

42. Sep 15, 2026
    Medium [CVE-2026-76707] EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents

    Medium4.3

43. Sep 15, 2026
    Medium [CVE-2026-76706] EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information

    Medium5.3

44. Sep 15, 2026
    Medium [CVE-2026-76705] EdgeConnect: buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways

    Medium5.5

45. Sep 15, 2026
    Medium [CVE-2026-76704] EdgeConnect: vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface

    Medium5.5

46. Sep 15, 2026
    Medium [CVE-2026-76703] EdgeConnect: buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow an authenticated attacker with administrative access to cause a denial of service

    Medium5.5

47. Sep 15, 2026
    Medium [CVE-2026-76702] EdgeConnect: vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service

    Medium5.8

48. Sep 15, 2026
    Medium [CVE-2026-76701] EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information

    Medium5.9

49. Sep 15, 2026
    Medium [CVE-2026-76700] EdgeConnect: Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service

    Medium5.9

50. Sep 15, 2026
    Medium [CVE-2026-76699] EdgeConnect: buffer overflow vulnerability exists in a system service within the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to cause a denial-of-service

    Medium6.4

51. Sep 15, 2026
    Medium [CVE-2026-76698] EdgeConnect: command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways

    Medium6.5

52. Sep 15, 2026
    Medium [CVE-2026-76697] EdgeConnect: vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privileges to access sensitive information

    Medium6.5

53. Sep 15, 2026
    Medium [CVE-2026-76696] EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct a denial of service attack

    Medium6.5

54. Sep 15, 2026
    Medium [CVE-2026-76695] EdgeConnect: Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to send specially crafted packets to the affected service

    Medium6.5

55. Sep 15, 2026
    Medium [CVE-2026-76694] EdgeConnect: privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways

    Medium6.6

56. Sep 9, 2026
    High [CVE-2026-73787] Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

    High7.2

57. Sep 9, 2026
    High [CVE-2026-73786] Unauthenticated Network-Based Denial of Service in CPPM systems

    High7.5

58. Sep 9, 2026
    High [CVE-2026-73769] Authenticated Remote Code Execution in CPPM Web Interface

    High7.2

59. Sep 9, 2026
    Medium [CVE-2026-73789] Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface

    Medium5.3

60. Sep 9, 2026
    Medium [CVE-2026-73788] ClearPass: vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment

    Medium6.5

61. Sep 1, 2026
    Critical [CVE-2026-73749] AOS-CX: Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input

    Critical9.8

62. Sep 1, 2026
    Critical [CVE-2026-76658] Fabric Composer: vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts

    Critical10.0

63. Sep 1, 2026
    Critical [CVE-2026-76657] Fabric Composer: Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls

    Critical10.0

64. Sep 1, 2026
    Critical [CVE-2026-73701] Unauthenticated Remote Code Execution in HPE Networking Fabric Composer

    Critical9.0

65. Sep 1, 2026
    Critical [CVE-2026-73700] Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface

    Critical9.0

66. Sep 1, 2026
    Critical [CVE-2026-19766] Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer

    Critical9.6

67. Sep 1, 2026
    High [CVE-2026-73782] AOS-CX: format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution

    High8.8

68. Sep 1, 2026
    High [CVE-2026-73781] AOS-CX: vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface

    High8.4

69. Sep 1, 2026
    High [CVE-2026-73780] AOS-CX: vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection

    High8.3

70. Sep 1, 2026
    High [CVE-2026-73779] AOS-CX: Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

    High8.2

71. Sep 1, 2026
    High [CVE-2026-73778] Credential Manager Vulnerability Allows Unauthorized Administrative Access

    High8.1

72. Sep 1, 2026
    High [CVE-2026-73777] AOS-CX: Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

    High8.1

73. Sep 1, 2026
    High [CVE-2026-73776] AOS-CX: signature verification bypass vulnerability exists in the command line interface of AOS-CX

    High7.9

74. Sep 1, 2026
    High [CVE-2026-73775] AOS-CX: Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information

    High7.7

75. Sep 1, 2026
    High [CVE-2026-73774] AOS-CX: buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system

    High7.6

76. Sep 1, 2026
    High [CVE-2026-73773] AOS-CX: unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX

    High7.5

77. Sep 1, 2026
    High [CVE-2026-73771] AOS-CX: authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing

    High7.5

78. Sep 1, 2026
    High [CVE-2026-73770] AOS-CX: authenticated arbitrary file write vulnerability exists in AOS-CX

    High7.3

79. Sep 1, 2026
    High [CVE-2026-73768] AOS-CX: vulnerability exists in the command line interface of AOS-CX that may allow for improper processing of malformed input

    High7.3

80. Sep 1, 2026
    High [CVE-2026-73767] AOS-CX: Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX

    High7.2

81. Sep 1, 2026
    High [CVE-2026-73766] AOS-CX: Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands

    High7.2

82. Sep 1, 2026
    High [CVE-2026-73765] AOS-CX: Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX

    High7.2

83. Sep 1, 2026
    High [CVE-2026-73764] AOS-CX: Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

    High7.1

84. Sep 1, 2026
    High [CVE-2026-73763] Unauthenticated Remote Command Execution in Management Component

    High7.1

85. Sep 1, 2026
    High [CVE-2026-73753] Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

    High8.8

86. Sep 1, 2026
    High [CVE-2026-73752] AOS-CX: unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX

    High8.8

87. Sep 1, 2026
    High [CVE-2026-73751] Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

    High8.8

88. Sep 1, 2026
    High [CVE-2026-73750] Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

    High8.8

89. Sep 1, 2026
    High [CVE-2026-73725] Fabric Composer: local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer

    High7.0

90. Sep 1, 2026
    High [CVE-2026-73724] Fabric Composer: Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer

    High7.1

91. Sep 1, 2026
    High [CVE-2026-73723] Fabric Composer: privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer

    High7.1

92. Sep 1, 2026
    High [CVE-2026-73722] Fabric Composer: Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system

    High7.2

93. Sep 1, 2026
    High [CVE-2026-73721] Fabric Composer: Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance

    High7.2

94. Sep 1, 2026
    High [CVE-2026-73720] Fabric Composer: Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution

    High7.2

95. Sep 1, 2026
    High [CVE-2026-73719] Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer

    High7.2

96. Sep 1, 2026
    High [CVE-2026-73718] Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer

    High7.4

97. Sep 1, 2026
    High [CVE-2026-73717] Unauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

    High7.5

98. Sep 1, 2026
    High [CVE-2026-73716] Unauthenticated Remote Code Execution in HPE Networking Fabric Composer

    High7.5

99. Sep 1, 2026
    High [CVE-2026-73715] Unauthenticated Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer

    High7.5

100. Sep 1, 2026
     High [CVE-2026-73714] Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API

     High7.6

Page 1 of 2 · 100 of 146