Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2022-37901 | 7.2 high | 3.0% | arubanetworks, sd-wan, arubaos | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 9 Oct |
| CVE-2022-37900 | 7.2 high | 3.0% | arubanetworks, sd-wan, arubaos | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 9 Oct |
| CVE-2022-37899 | 7.2 high | 3.0% | arubanetworks, sd-wan, arubaos | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 9 Oct |
| CVE-2022-37897 | 9.8 critical | 2.0% | arubanetworks, sd-wan, arubaos | There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. | 8 Oct |
| CVE-2023-22789 | 8.8 high | 2.0% | arubanetworks, hp, arubaos, instantos | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 13 h ago |
| CVE-2022-37912 | 8.8 high | 2.0% | arubanetworks, sd-wan, arubaos | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 8 Oct |
| CVE-2022-37902 | 7.2 high | 2.0% | arubanetworks, sd-wan, arubaos | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 9 Oct |
| CVE-2026-44866 | 8.8 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44867 | 8.8 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44868 | 8.8 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44869 | 8.8 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44870 | 8.8 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44871 | 8.8 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44880 | 8.8 high | 1.0% | hpe, arubaos-cx | A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system. | Sat 24 Oct |
| CVE-2025-37162 | 8.8 high | 1.0% | arubanetworks, arubaos | A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | 18 Oct |
| CVE-2025-37157 | 8.8 high | 1.0% | hpe, arubaos-cx | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system. | 18 Oct |
| CVE-2025-37158 | 8.8 high | 1.0% | hpe, arubaos-cx | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system. | 18 Oct |
| CVE-2022-37903 | 8.8 high | 1.0% | arubanetworks, sd-wan, arubaos | A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful exploitation of this vulnerability could lead to full compromise the underlying host operating system. | 9 Oct |
| CVE-2022-37904 | 8.8 high | 1.0% | arubanetworks, sd-wan, arubaos | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system. | 9 Oct |
| CVE-2022-37905 | 8.8 high | 1.0% | arubanetworks, sd-wan, arubaos | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful exploitation could allow an attacker to achieve permanent modification of the underlying operating system. | 9 Oct |
| CVE-2022-37906 | 8.1 high | 1.0% | arubanetworks, sd-wan, arubaos | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability to delete arbitrary files on the underlying operating system. | 8 Oct |
| CVE-2026-23827 | 7.5 high | 1.0% | arubanetworks, arubaos, sd-wan | A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process. | Mon 26 Oct |
| CVE-2022-37907 | 7.5 high | 1.0% | arubanetworks, sd-wan, arubaos | A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A successful attacker can cause a system hang which can only be resolved via a power cycle of the impacted controller. | 8 Oct |
| CVE-2026-23820 | 7.2 high | 1.0% | arubanetworks, arubaos | A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-23821 | 7.2 high | 1.0% | arubanetworks, arubaos | A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability. | Mon 26 Oct |
| CVE-2026-23823 | 7.2 high | 1.0% | arubanetworks, arubaos | A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability. | Mon 26 Oct |
| CVE-2026-44853 | 7.2 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user. | Mon 26 Oct |
| CVE-2026-44854 | 7.2 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user. | Mon 26 Oct |
| CVE-2026-44865 | 7.2 high | 1.0% | arubanetworks, arubaos, sd-wan | Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44872 | 7.2 high | 1.0% | arubanetworks, arubaos, sd-wan | A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device. | Mon 26 Oct |
| CVE-2026-63453 | 7.2 high | 1.0% | hpe, arubaos-cx | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system. | Sat 24 Oct |
| CVE-2026-63454 | 7.2 high | 1.0% | hpe, arubaos-cx | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution. | Sat 24 Oct |
| CVE-2022-37898 | 7.2 high | 1.0% | arubanetworks, sd-wan, arubaos | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. | 9 Oct |
| CVE-2025-37132 | 7.2 high | 1.0% | arubanetworks, arubaos | An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system. | 8 Oct |
| CVE-2025-37133 | 7.2 high | 1.0% | arubanetworks, arubaos | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | 8 Oct |
| CVE-2025-37134 | 7.2 high | 1.0% | arubanetworks, arubaos | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation could allow an authenticated malicious actor to execute arbitrary commands as a privileged user on the underlying operating system. | 8 Oct |
| CVE-2022-37910 | 6.5 medium | 1.0% | arubanetworks, sd-wan, arubaos | A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a denial of service on the affected system. | 8 Oct |
| CVE-2025-37138 | 6.2 medium | 1.0% | arubanetworks, arubaos | An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system. Exploitation of this vulnerability requires physical access to the hardware controllers. A successful attack could allow an authenticated malicious actor with physical access to execute arbitrary commands as a privileged user on the underlying operating system. | 8 Oct |
| CVE-2022-37911 | 5.5 medium | 1.0% | arubanetworks, sd-wan, arubaos | Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authenticated attacker to retrieve files from the local system or cause the application to consume system resources, resulting in a denial of service condition. | 8 Oct |
| CVE-2026-23819 | 8.8 high | 0.00% | arubanetworks, arubaos | A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings. | Mon 26 Oct |
| CVE-2025-37155 | 7.8 high | 0.00% | hpe, arubaos-cx | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system. | 18 Oct |
| CVE-2026-23824 | 7.5 high | 0.00% | arubanetworks, arubaos, sd-wan | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition. | Mon 26 Oct |
| CVE-2026-23825 | 7.5 high | 0.00% | arubanetworks, arubaos, sd-wan | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition. | Mon 26 Oct |
| CVE-2026-23826 | 7.5 high | 0.00% | arubanetworks, arubaos, sd-wan | A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations. | Mon 26 Oct |
| CVE-2025-37161 | 7.5 high | 0.00% | arubanetworks, arubaos | A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations. | 18 Oct |
| CVE-2025-37159 | 7.3 high | 0.00% | hpe, arubaos-cx | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data. | 18 Oct |
| CVE-2026-44852 | 7.2 high | 0.00% | arubanetworks, arubaos, sd-wan | An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user. | Mon 26 Oct |
| CVE-2026-44855 | 7.2 high | 0.00% | arubanetworks, arubaos, sd-wan | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44859 | 7.2 high | 0.00% | arubanetworks, arubaos, sd-wan | Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system. | Mon 26 Oct |
| CVE-2026-44860 | 7.2 high | 0.00% | arubanetworks, arubaos, sd-wan | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system. | Mon 26 Oct |
50 of 73 · Next
Download these 73 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.