Hewlett Packard Enterprise (Hpe) vulnerabilities, page 2
594 vulnerabilities
Known vulnerabilities in Hewlett Packard Enterprise (Hpe) products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 86 products.
CVE-2025-37122hewlett packard enterprise (hpe)hpe aruba networking clearpass policy manager
EPSS score0.25%
A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected Cross-Site Scripting (XSS) attack. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in a victim's browser in the context of the affected interface.CVE-2025-37144arubanetworksarubaos+1EPSS score0.45%
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.CVE-2025-37135arubanetworksarubaos+1EPSS score0.36%
Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.CVE-2025-37156hewlett packard enterprise (hpe)hpe aruba networking aos-cx+1EPSS score0.32%
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional.CVE-2025-37147hewlett packard enterprise (hpe)arubaos (aos)EPSS score0.15%
A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensure only vendor-signed firmware can execute on the device. An adversary can exploit this vulnerability to run modified or custom firmware on affected Access Points.CVE-2025-37104hewlett packard enterprise (hpe)hpe telco service orchestratorEPSS score0.25%
A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated clients.CVE-2025-37103hewlett packard enterprise (hpe)hpe networking instant onEPSS score1.09%
Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system.CVE-2025-37145arubanetworksarubaos+1EPSS score0.45%
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.CVE-2025-37089hewlett packard enterprise (hpe)hpe storeonce software+1EPSS score1.25%
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-37131hewlett packard enterprise (hpe)hpe aruba networking edgeconnect sd-wan gatewayEPSS score0.32%
A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files. Under certain conditions, this could lead to exposure and exfiltration of sensitive information.CVE-2025-37157hewlett packard enterprise (hpe)hpe aruba networkign aos-cx+1EPSS score0.64%
A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.CVE-2025-37137arubanetworksarubaos+1EPSS score0.36%
Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated remote malicious actor to delete arbitrary files within the affected system.CVE-2025-37164hewlett packard enterprise (hpe)hpe oneview+1KEVEPSS score90.19%
A remote code execution issue exists in HPE OneView.CVE-2025-37140arubanetworksarubaos+1EPSS score0.35%
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully constructed exploits.CVE-2025-37158hewlett packard enterprise (hpe)hpe aruba networking aos-cx+1EPSS score0.64%
A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system.CVE-2025-37130hewlett packard enterprise (hpe)hpe aruba networking edgeconnect sd-wan gatewayEPSS score0.32%
A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful exploitation could allow an attacker to read sensitive data from the underlying file system.CVE-2025-37092hewlett packard enterprise (hpe)hpe storeonce software+1EPSS score1.25%
A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-37169arubanetworksarubaos+1EPSS score0.57%
A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system.CVE-2025-37128hewlett packard enterprise (hpe)hpe aruba networking edgeconnect sd-wan gatewayEPSS score0.32%
A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running processes. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state.CVE-2025-37132arubanetworksarubaos+1EPSS score0.55%
An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to upload arbitrary files and execute arbitrary commands on the underlying operating system.