HPE Aruba Networking Security Advisories & CVEs
34 advisories tracked · HPE Aruba Networking Security Advisories (PSIRT) via NVD · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Aruba CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Check if your Aruba device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Aruba's recent advisories.
Official source
HPE Aruba Networking Security Advisories (PSIRT) via NVD
Aruba's PSIRT bulletin portal (arubanetworks.com) is a JavaScript app with no stable public feed, so VulniPulse ingests Aruba's CVEs from NVD. Aruba publishes under the shared HPE CNA (security-alert@hpe.com), which also covers non-networking HPE products — so this feed is filtered to the full HPE Aruba Networking portfolio: ClearPass, AOS-8 mobility controllers, AOS-10 gateways and APs, Instant APs, AOS-CX and legacy AOS-Switch, Aruba Central, Fabric Composer and EdgeConnect/Silver Peak SD-WAN. Each entry links back to the official Aruba/HPE advisory when NVD carries the reference.
Latest Aruba advisories
Critical [CVE-2026-79805] ClearPass Policy Manager: authenticated path traversal vulnerability exists in ClearPass Policy Manager
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79801] ClearPass Policy Manager: missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code
A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to execute arbitrary code on the affected client system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79798] ClearPass Policy Manager: SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79796] ClearPass Policy Manager: Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls
Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain unauthorized access to the affected system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-79794] ClearPass Policy Manager: SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76754] ClearPass Policy Manager: vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary database commands. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76753] ClearPass Policy Manager: format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory
A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an attacker to execute arbitrary code. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76752] ClearPass Policy Manager: Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager
Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent existing authentication controls and gain administrative access to the affected system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76751] ClearPass Policy Manager: missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager
A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected endpoint with the elevated privileges of the agent. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76750] ClearPass Policy Manager: Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager
Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system. Affected product named by the advisory: ClearPass Policy Manager (CPPM).
Critical [CVE-2026-76747] Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to expose sensitive memory contents and cause a denial of service on the device. Affected product named by the advisory: AOS-Switch (AOS-S).
Critical [CVE-2026-76746] Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device. Affected product named by the advisory: AOS-Switch (AOS-S).
Critical [CVE-2026-76745] Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S
Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code. Affected product named by the advisory: AOS-Switch (AOS-S).
Critical [CVE-2026-76744] Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code. Affected product named by the advisory: AOS-Switch (AOS-S).
Critical [CVE-2026-76743] Authentication Bypass Vulnerability in the Management Interface of AOS-S
A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system. Affected product named by the advisory: AOS-Switch (AOS-S).
Critical [CVE-2026-76742] Authentication Bypass in the Web Management Interface of AOS-S
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system. Affected product named by the advisory: AOS-Switch (AOS-S).
Critical [CVE-2026-76725] Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs
A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges.
Critical [CVE-2026-76724] Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Critical [CVE-2026-76723] Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Critical [CVE-2026-76722] Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs
Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.