AR
Product
Arubaos
233
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 45High 121Medium 56Low 4
Watch
Add Arubaos to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44871 | 8.8 | May 12 | Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-44870 | 8.8 | May 12 | Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-44869 | 8.8 | May 12 | Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10 Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-44868 | 8.8 | May 12 | Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10 Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-44867 | 8.8 | May 12 | Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10 Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-44866 | 8.8 | May 12 | Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10 Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-23819 | 8.8 | May 12 | Error in SSID Processing allows Stored XSS in Web Management Interface Affected: 6.4.0.0 through 6.5.4.24; 8.4.0.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.3.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3; +1 more |
| CVE-2025-37162 | 8.8 | Nov 18 | A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack Affected: 10.7.1.0 before 10.7.2.0 |
| CVE-2024-31477 | 8.8 | May 14 | Multiple authenticated command injection vulnerabilities exist in the command line interface Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-31476 | 8.8 | May 14 | Multiple authenticated command injection vulnerabilities exist in the command line interface Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2023-22790 | 8.8 | May 8 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface Affected: 10.3.0.0 through 10.3.1.0 |
| CVE-2023-22789 | 8.8 | May 8 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface Affected: 10.3.0.0 through 10.3.1.0 |
| CVE-2023-22788 | 8.8 | May 8 | Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface Affected: 10.3.0.0 through 10.3.1.0 |
| CVE-2022-37912 | 8.8 | Dec 12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0 |
| CVE-2022-37905 | 8.8 | Dec 12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0 |
| CVE-2022-37904 | 8.8 | Dec 12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0 |
| CVE-2022-37903 | 8.8 | Dec 12 | A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0 |
| CVE-2024-31475 | 8.2 | May 14 | There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol) Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-31474 | 8.2 | May 14 | There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol) Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2023-45619 | 8.2 | Nov 14 | There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol) Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-45618 | 8.2 | Nov 14 | There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol) Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-45617 | 8.2 | Nov 14 | There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol) Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2026-23808 | 8.1 | Mar 4 | Client Isolation Bypass via GTK Manipulation Affected: 6.5.4.0 through 8.10.0.21; 8.11.0.0 through 8.12.0.6; 8.13.0.0 through 8.13.1.1; 10.3.0.0 through 10.4.1.10; 10.5.0.0 through 10.7.2.2; 10.8.0.0 |
| CVE-2023-35975 | 8.1 | Jul 5 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2 |
| CVE-2022-37906 | 8.1 | Dec 12 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0 |
| CVE-2021-37725 | 8.1 | Sep 7 | A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to… Affected: 8.3.0.0 before 8.3.0.15; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.8; 8.7.0.0 before 8.7.1.2; 8.8.0.0 before 8.8.0.1 |
| CVE-2022-37893 | 7.8 | Oct 7 | An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface Affected: 10.3.0.0 before 10.3.1.1 |
| CVE-2026-23809 | 7.6 | Mar 4 | MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection Affected: 6.5.4.0 through 8.10.0.21; 8.11.0.0 through 8.12.0.6; 8.13.0.0 through 8.13.1.1; 10.3.0.0 through 10.4.1.10; 10.5.0.0 through 10.7.2.2; 10.8.0.0 |
| CVE-2026-23827 | 7.5 | May 12 | Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-23826 | 7.5 | May 12 | Unauthenticated Denial of Service in AOS-8 Network Management Service Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2 |
| CVE-2026-23825 | 7.5 | May 12 | Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2026-23824 | 7.5 | May 12 | Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.4.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3 |
| CVE-2025-37178 | 7.5 | Jan 13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers Affected: 8.6.0.0 before 8.10.0.21; 8.11.0.0 before 8.13.1.1 |
| CVE-2025-37161 | 7.5 | Nov 18 | A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service Affected: 10.7.1.0 before 10.7.2.0 |
| CVE-2024-31482 | 7.5 | May 14 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-31481 | 7.5 | May 14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-31480 | 7.5 | May 14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-31479 | 7.5 | May 14 | Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-31478 | 7.5 | May 14 | Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1 |
| CVE-2024-33517 | 7.5 | May 1 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0 |
| CVE-2024-33516 | 7.5 | May 1 | An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0 |
| CVE-2024-33515 | 7.5 | May 1 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0 |
| CVE-2024-33514 | 7.5 | May 1 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0 |
| CVE-2023-45624 | 7.5 | Nov 14 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-45623 | 7.5 | Nov 14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-45622 | 7.5 | Nov 14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-45621 | 7.5 | Nov 14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-45620 | 7.5 | Nov 14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0 |
| CVE-2023-35979 | 7.5 | Jul 5 | There is an unauthenticated buffer overflow vulnerability in the process controlling the ArubaOS web-based management interface Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2 |
| CVE-2023-22787 | 7.5 | May 8 | An unauthenticated Denial of Service (DoS) vulnerability exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10 Affected: 10.3.0.0 through 10.3.1.0 |
