AR
Product
Arubaos
by Arubanetworks · last CVE May 12, 2026
233
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 45High 121Medium 56Low 4
Watch

Add Arubaos to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-44871
8.8
1%
May 12
Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-44870
8.8
1%
May 12
Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-44869
8.8
1%
May 12
Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-44868
8.8
1%
May 12
Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-44867
8.8
1%
May 12
Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-44866
8.8
1%
May 12
Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-23819
8.8
0%
May 12
Error in SSID Processing allows Stored XSS in Web Management Interface
Affected: 6.4.0.0 through 6.5.4.24; 8.4.0.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.3.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3; +1 more
CVE-2025-37162
8.8
1%
Nov 18
A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack
Affected: 10.7.1.0 before 10.7.2.0
CVE-2024-31477
8.8
1%
May 14
Multiple authenticated command injection vulnerabilities exist in the command line interface
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-31476
8.8
1%
May 14
Multiple authenticated command injection vulnerabilities exist in the command line interface
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2023-22790
8.8
2%
May 8
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface
Affected: 10.3.0.0 through 10.3.1.0
CVE-2023-22789
8.8
2%
May 8
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface
Affected: 10.3.0.0 through 10.3.1.0
CVE-2023-22788
8.8
2%
May 8
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface
Affected: 10.3.0.0 through 10.3.1.0
CVE-2022-37912
8.8
2%
Dec 12
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37905
8.8
1%
Dec 12
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37904
8.8
1%
Dec 12
Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37903
8.8
1%
Dec 12
A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2024-31475
8.2
0%
May 14
There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol)
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-31474
8.2
0%
May 14
There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol)
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2023-45619
8.2
1%
Nov 14
There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol)
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-45618
8.2
1%
Nov 14
There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol)
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-45617
8.2
1%
Nov 14
There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol)
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2026-23808
8.1
0%
Mar 4
Client Isolation Bypass via GTK Manipulation
Affected: 6.5.4.0 through 8.10.0.21; 8.11.0.0 through 8.12.0.6; 8.13.0.0 through 8.13.1.1; 10.3.0.0 through 10.4.1.10; 10.5.0.0 through 10.7.2.2; 10.8.0.0
CVE-2023-35975
8.1
1%
Jul 5
An authenticated path traversal vulnerability exists in the ArubaOS command line interface
Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2022-37906
8.1
1%
Dec 12
An authenticated path traversal vulnerability exists in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2021-37725
8.1
0%
Sep 7
A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to…
Affected: 8.3.0.0 before 8.3.0.15; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.8; 8.7.0.0 before 8.7.1.2; 8.8.0.0 before 8.8.0.1
CVE-2022-37893
7.8
1%
Oct 7
An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface
Affected: 10.3.0.0 before 10.3.1.1
CVE-2026-23809
7.6
0%
Mar 4
MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection
Affected: 6.5.4.0 through 8.10.0.21; 8.11.0.0 through 8.12.0.6; 8.13.0.0 through 8.13.1.1; 10.3.0.0 through 10.4.1.10; 10.5.0.0 through 10.7.2.2; 10.8.0.0
CVE-2026-23827
7.5
1%
May 12
Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-23826
7.5
0%
May 12
Unauthenticated Denial of Service in AOS-8 Network Management Service
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2
CVE-2026-23825
7.5
0%
May 12
Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2026-23824
7.5
0%
May 12
Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3
CVE-2025-37178
7.5
0%
Jan 13
Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers
Affected: 8.6.0.0 before 8.10.0.21; 8.11.0.0 before 8.13.1.1
CVE-2025-37161
7.5
0%
Nov 18
A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service
Affected: 10.7.1.0 before 10.7.2.0
CVE-2024-31482
7.5
1%
May 14
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-31481
7.5
1%
May 14
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-31480
7.5
1%
May 14
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-31479
7.5
1%
May 14
Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-31478
7.5
1%
May 14
Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2024-33517
7.5
1%
May 1
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol
Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0
CVE-2024-33516
7.5
1%
May 1
An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS
Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0
CVE-2024-33515
7.5
1%
May 1
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol
Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0
CVE-2024-33514
7.5
1%
May 1
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol
Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0
CVE-2023-45624
7.5
1%
Nov 14
An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-45623
7.5
1%
Nov 14
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-45622
7.5
1%
Nov 14
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-45621
7.5
1%
Nov 14
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-45620
7.5
1%
Nov 14
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-35979
7.5
1%
Jul 5
There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface
Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2023-22787
7.5
1%
May 8
An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10
Affected: 10.3.0.0 through 10.3.1.0
Page 1 of 3 · 121 total