Aruba security advisories, October 2026

Every HPE Aruba Networking security advisory published in October 2026, from HPE Aruba Networking Security Advisories (PSIRT) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 105
Critical: 46
High: 41
In CISA KEV: 0

Aruba advisories published in October 2026

Oct 22, 2026
Critical [CVE-2026-79876] AOS-10: sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information
Critical9.3
Oct 22, 2026
Critical [CVE-2026-79875] AOS-8: vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls
Critical9.3
Oct 22, 2026
Critical [CVE-2026-79874] AOS-10: authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls
Critical9.3
Oct 22, 2026
Critical [CVE-2026-79873] AOS-10: Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls
Critical9.3
Oct 22, 2026
Critical [CVE-2026-79872] Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8
Critical9.4
Oct 22, 2026
Critical [CVE-2026-79871] AOS-10: sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79870] AOS-8: authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79869] AOS-10: Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79868] AOS-8: Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79867] AOS-8: Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79866] AOS-8: unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79865] AOS-10: memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79864] AOS-10: Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79863] AOS-10: Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface
Critical9.6
Oct 22, 2026
Critical [CVE-2026-79861] AOS-10: There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79860] AOS-8: Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79859] AOS-8: Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79858] AOS-8: unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79857] AOS-8: There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79856] AOS-8: buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79855] AOS-8: authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79854] AOS-10: vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79853] AOS-10: Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79852] Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface
Critical9.8
Oct 22, 2026
Critical [CVE-2026-79851] Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
Critical10.0
Oct 22, 2026
Critical [CVE-2026-79850] Authentication Bypass Leading to Remote Code Execution in AOS-8
Critical10.0
Oct 22, 2026
Critical [CVE-2026-79849] Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
Critical10.0
Oct 22, 2026
Critical [CVE-2026-79847] Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
Critical10.0
Oct 22, 2026
Critical [CVE-2026-79846] Unauthenticated Command Injection Vulnerabilities in AOS-8
Critical10.0
Oct 22, 2026
Critical [CVE-2026-79844] Authentication Bypass Leading to Remote Code Execution in AOS-10
Critical10.0
Oct 22, 2026
High [CVE-2026-95713] AOS-8: unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8
High7.0
Oct 22, 2026
High [CVE-2026-95712] AOS-8: sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service
High7.1
Oct 22, 2026
High [CVE-2026-95711] AOS-10: authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met
High7.1
Oct 22, 2026
High [CVE-2026-95710] AOS-10: unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack
High7.1
Oct 22, 2026
High [CVE-2026-95709] AOS-10: Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection
High7.2
Oct 22, 2026
High [CVE-2026-95707] AOS-8: buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution
High7.2
Oct 22, 2026
High [CVE-2026-95706] AOS-8: Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection
High7.2
Oct 22, 2026
High [CVE-2026-95704] Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface
High7.2
Oct 22, 2026
High [CVE-2026-79956] AOS-8: vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system
High7.2
Oct 22, 2026
High [CVE-2026-79955] AOS-8: unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack
High7.5
Oct 22, 2026
High [CVE-2026-79895] AOS-10: Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack
High7.5
Oct 22, 2026
High [CVE-2026-79894] AOS-8: unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8
High7.5
Oct 22, 2026
High [CVE-2026-79893] AOS-10: Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack
High7.5
Oct 22, 2026
High [CVE-2026-79892] AOS-8: memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code
High7.8
Oct 22, 2026
High [CVE-2026-79891] AOS-8: buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met
High8.1
Oct 22, 2026
High [CVE-2026-79890] AOS-8: There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets
High8.1
Oct 22, 2026
High [CVE-2026-79889] AOS-8: Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests
High8.1
Oct 22, 2026
High [CVE-2026-79888] AOS-8: vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow
High8.1
Oct 22, 2026
High [CVE-2026-79887] AOS-8: vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution
High8.1
Oct 22, 2026
High [CVE-2026-79886] AOS-8: unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8
High8.2
Oct 22, 2026
High [CVE-2026-79885] AOS-8: unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8
High8.2
Oct 22, 2026
High [CVE-2026-79884] AOS-8: vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information
High8.2
Oct 22, 2026
High [CVE-2026-79883] AOS-10: buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information
High8.3
Oct 22, 2026
High [CVE-2026-79882] AOS-10: There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets
High8.3
Oct 22, 2026
High [CVE-2026-79881] AOS-8: authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls
High8.3
Oct 22, 2026
High [CVE-2026-79880] AOS-8: vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack
High8.7
Oct 22, 2026
High [CVE-2026-79879] AOS-10: Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker
High8.8
Oct 22, 2026
High [CVE-2026-79878] AOS-8: command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211
High8.8
Oct 22, 2026
High [CVE-2026-79877] AOS-10: remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device
High8.8
Oct 22, 2026
Medium [CVE-2026-95720] AOS-8: buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service
Medium4.4
Oct 22, 2026
Medium [CVE-2026-95719] AOS-10: arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service
Medium4.9
Oct 22, 2026
Medium [CVE-2026-95718] AOS-8: authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls
Medium5.3
Oct 22, 2026
Medium [CVE-2026-95717] Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface
Medium5.5
Oct 22, 2026
Medium [CVE-2026-95716] AOS-10: authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls
Medium6.5
Oct 22, 2026
Medium [CVE-2026-95715] AOS-10: unauthenticated command injection vulnerability exists in the command line interface of AOS-10
Medium6.8
Oct 22, 2026
Medium [CVE-2026-95714] AOS-10: buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution
Medium6.8
Oct 22, 2026
Low [CVE-2026-95721] AOS-8: memory corruption vulnerability exists in the web-based management interface of AOS-8
Low3.3
Oct 6, 2026
Critical [CVE-2026-79805] ClearPass Policy Manager: authenticated path traversal vulnerability exists in ClearPass Policy Manager
Critical9.8
Oct 6, 2026
Critical [CVE-2026-79801] ClearPass Policy Manager: missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code
Critical9.8
Oct 6, 2026
Critical [CVE-2026-79798] ClearPass Policy Manager: SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
Critical9.9
Oct 6, 2026
Critical [CVE-2026-79796] ClearPass Policy Manager: Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls
Critical9.8
Oct 6, 2026
Critical [CVE-2026-79794] ClearPass Policy Manager: SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
Critical9.1
Oct 6, 2026
Critical [CVE-2026-76754] ClearPass Policy Manager: vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76753] ClearPass Policy Manager: format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76752] ClearPass Policy Manager: Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76751] ClearPass Policy Manager: missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76750] ClearPass Policy Manager: Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76747] Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S
Critical9.1
Oct 6, 2026
Critical [CVE-2026-76746] Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S
Critical9.3
Oct 6, 2026
Critical [CVE-2026-76745] Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S
Critical9.6
Oct 6, 2026
Critical [CVE-2026-76744] Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76743] Authentication Bypass Vulnerability in the Management Interface of AOS-S
Critical9.8
Oct 6, 2026
Critical [CVE-2026-76742] Authentication Bypass in the Web Management Interface of AOS-S
Critical9.8
Oct 6, 2026
High [CVE-2026-79811] ClearPass Policy Manager: SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance
High7.2
Oct 6, 2026
High [CVE-2026-79810] ClearPass Policy Manager: Remote code execution vulnerabilities exist in the affected interface of HPE Networking ClearPass Policy Manager that could allow an authenticated remote attacker with high privileges to execute arbitrary code
High7.2
Oct 6, 2026
High [CVE-2026-79809] ClearPass Policy Manager: unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager
High7.3
Oct 6, 2026
High [CVE-2026-79808] ClearPass Policy Manager: buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager
High7.8
Oct 6, 2026
High [CVE-2026-79807] ClearPass Policy Manager: missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges
High7.8
Oct 6, 2026
High [CVE-2026-79806] ClearPass Policy Manager: privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges
High7.8
Oct 6, 2026
High [CVE-2026-79803] ClearPass Policy Manager: command injection vulnerability exists in the API of ClearPass Policy Manager
High8.8
Oct 6, 2026
High [CVE-2026-79802] ClearPass Policy Manager: command injection vulnerability exists in the client software of ClearPass Policy Manager
High8.8
Oct 6, 2026
High [CVE-2026-79800] ClearPass Policy Manager: authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager
High8.8
Oct 6, 2026
High [CVE-2026-79799] ClearPass Policy Manager: vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface
High8.8
Oct 6, 2026
High [CVE-2026-79797] ClearPass Policy Manager: improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources
High8.8
Oct 6, 2026
High [CVE-2026-76748] Authenticated Privilege Escalation Vulnerability in the API of AOS-S
High8.8
Oct 6, 2026
Medium [CVE-2026-79818] ClearPass Policy Manager: vulnerability in an API interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to circumvent existing authentication controls
Medium5.3
Oct 6, 2026
Medium [CVE-2026-79817] ClearPass Policy Manager: sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager
Medium5.5
Oct 6, 2026
Medium [CVE-2026-79816] ClearPass Policy Manager: vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting (XSS) attack against a user of the affected client interface
Medium6.3
Oct 6, 2026
Medium [CVE-2026-79815] ClearPass Policy Manager: command injection vulnerability in the OnGuard agent of ClearPass Policy Manager could allow an authenticated remote attacker to inject arbitrary commands
Medium6.5
Oct 6, 2026
Medium [CVE-2026-79814] ClearPass Policy Manager: arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privileges if certain preconditions outside of the attacker's control are met
Medium6.7

Page 1 of 2 · 100 of 105

Get an email when Aruba publishes the next one.

See Aruba's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Aruba

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.