CVE-2025-37159: hewlett packard enterprise (hpe) hpe aruba networking aos-cx Session Fixation

Vulnerability summary

CVE-2025-37159 is a high (CVSS 7.3) Session Fixation vulnerability in hewlett packard enterprise (hpe) hpe aruba networking aos-cx. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.7% of scored vulnerabilities.

Timeline

1. 18-11-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.