Login Request a demo
AR
Product
Arubaos
by Arubanetworks · last CVE May 12, 2026
233
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities233In the news0Timeline
Severity mix
Critical 45High 121Medium 56Low 4
Severity
All severities233Critical45High121Medium56Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Arubaos to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-22758
7.2
2%
Mar 1
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface
Affected: 8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0
CVE-2022-37902
7.2
2%
Dec 12
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37901
7.2
3%
Dec 12
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37900
7.2
3%
Dec 12
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37899
7.2
3%
Dec 12
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37898
7.2
1%
Dec 12
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 through 8.10.0.0; 10.3.0.0
CVE-2021-37724
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16
Affected: 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.8; 8.7.0.0 before 8.7.1.2
CVE-2021-37723
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16
Affected: 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.8; 8.7.0.0 before 8.7.1.2
CVE-2021-37722
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4;…
Affected: 6.4.4.0 before 6.4.4.25; 6.5.4.0 before 6.5.4.20; 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.13; 8.6.0.0 before 8.6.0.9; 8.7.0.0 before 8.7.1.4
CVE-2021-37721
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4;…
Affected: 6.4.4.0 before 6.4.4.25; 6.5.4.0 before 6.5.4.20; 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.13; 8.6.0.0 before 8.6.0.9; 8.7.0.0 before 8.7.1.4
CVE-2021-37720
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4;…
Affected: 6.4.4.0 before 6.4.4.25; 6.5.4.0 before 6.5.4.20; 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.13; 8.6.0.0 before 8.6.0.9; 8.7.0.0 before 8.7.1.4
CVE-2021-37719
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4;…
Affected: 6.4.4.0 before 6.4.4.25; 6.5.4.0 before 6.5.4.20; 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.13; 8.6.0.0 before 8.6.0.9; 8.7.0.0 before 8.7.1.4
CVE-2021-37718
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6;…
Affected: 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.7; 8.7.0.0 before 8.7.1.4
CVE-2021-37717
7.2
3%
Sep 7
A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6;…
Affected: 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.6; 8.7.0.0 before 8.7.1.4
CVE-2020-24637
7.2
2%
Dec 11
Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot
Affected: before 8.5.0.11; 8.6.0.0 before 8.6.0.6; 8.7.0.0 before 8.7.1.0
CVE-2019-5315
7.2
2%
Sep 13
A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated user to execute arbitrary commands on the underlying…
Affected: 8.0.0.0 before 8.3.0.0
CVE-2025-37177
6.5
0%
Jan 13
Authenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)
Affected: 6.5.4.0 before 8.10.0.21; 8.11.0.0 before 8.13.1.1; 10.3.0.0 before 10.4.1.10; 10.5.0.0 before 10.7.2.2
CVE-2025-37137
6.5
0%
Oct 14
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
Affected: 8.10.0.0 before 8.10.0.19; 8.12.0.0 before 8.12.0.6; 8.13.0.0 before 8.13.1.0; 10.4.0.0 before 10.4.1.9; 10.7.0.0 before 10.7.2.1
CVE-2025-37136
6.5
0%
Oct 14
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
Affected: 8.10.0.0 before 8.10.0.19; 8.12.0.0 before 8.12.0.6; 8.13.0.0 before 8.13.1.0; 10.4.0.0 before 10.4.1.9; 10.7.0.0 before 10.7.2.1
CVE-2025-37135
6.5
0%
Oct 14
Authenticated Arbitrary File Deletion Vulnerabilities in AOS-8 Controller/Mobility Conductor Command Line Interface (CLI)
Affected: 8.10.0.0 before 8.10.0.19; 8.12.0.0 before 8.12.0.6; 8.13.0.0 before 8.13.1.0; 10.4.0.0 before 10.4.1.9; 10.7.0.0 before 10.7.2.1
CVE-2024-31483
6.5
0%
May 14
An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol
Affected: 10.3.0.0 before 10.4.1.1; 10.5.0.0 before 10.5.1.1
CVE-2023-45627
6.5
1%
Nov 14
An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service
Affected: 10.3.0.0 before 10.4.0.3; 10.5.0.0
CVE-2023-35977
6.5
1%
Jul 5
Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface
Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2023-35976
6.5
1%
Jul 5
Vulnerabilities exist which allow an authenticated attacker to access sensitive information on the ArubaOS command line interface
Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2023-22777
6.5
1%
Mar 1
An authenticated information disclosure vulnerability exists in the ArubaOS web-based management interface
Affected: 8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0
CVE-2023-22775
6.5
1%
Mar 1
A vulnerability exists which allows an authenticated attacker to access sensitive information on the ArubaOS command line interface
Affected: 8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0
CVE-2023-22774
6.5
1%
Mar 1
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface
Affected: 8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0
CVE-2023-22773
6.5
1%
Mar 1
Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface
Affected: 8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0
CVE-2023-22772
6.5
1%
Mar 1
An authenticated path traversal vulnerability exists in the ArubaOS web-based management interface
Affected: 8.6.0.0 through 8.6.0.19; 8.10.0.0 through 8.10.0.4; 10.3.0.0 through 10.3.1.0
CVE-2022-37910
6.5
1%
Dec 12
A buffer overflow vulnerability exists in the ArubaOS command line interface
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37908
6.5
0%
Dec 12
An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2022-37894
6.5
0%
Oct 7
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10
Affected: 10.3.0.0 before 10.3.1.1
CVE-2021-37729
6.5
1%
Sep 7
A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.3,…
Affected: 6.4.4.0 before 6.4.4.25; 6.5.4.0 before 6.5.4.19; 8.3.0.0 before 8.3.0.16; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.9; 8.7.0.0 before 8.7.1.3
CVE-2021-37728
6.5
1%
Sep 7
A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5.0.13
Affected: 8.5.0.0 before 8.5.0.13; 8.6.0.0 before 8.6.0.11; 8.7.0.0 before 8.7.1.4; 8.8.0.0 before 8.8.0.1
CVE-2019-5318
6.5
0%
Sep 7
A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versions, 8.x.x.x: all versions prior to…
Affected: 6.1.3.7 through 6.5.4.20; 8.0.0.0 before 8.8.0.0
CVE-2023-38486
6.4
0%
Sep 6
A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would…
Affected: 8.6.0.0 before 8.6.0.22; 8.10.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2023-38485
6.4
0%
Sep 6
Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the…
Affected: 8.6.0.0 before 8.6.0.22; 8.10.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2023-38484
6.4
0%
Sep 6
Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code early in the…
Affected: 8.6.0.0 before 8.6.0.22; 8.10.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2025-37138
6.2
1%
Oct 14
Authenticated Command Injection Vulnerability in CLI Binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-Based Management Interface (Physical Access Required)
Affected: 8.10.0.0 before 8.10.0.19; 8.12.0.0 before 8.12.0.6; 8.13.0.0 before 8.13.1.0; 10.4.0.0 before 10.4.1.9; 10.7.0.0 before 10.7.2.1
CVE-2021-37731
6.2
0%
Sep 7
A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1,…
Affected: 8.3.0.0 before 8.3.0.15; 8.5.0.0 before 8.5.0.12; 8.6.0.0 before 8.6.0.8; 8.7.0.0 before 8.7.1.2
CVE-2025-27084
6.1
0%
Apr 8
A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS)…
Affected: 8.10.0.0 before 8.10.0.16; 8.12.0.0 before 8.12.0.4; 10.4.0.0 before 10.4.1.7; 10.7.0.0 before 10.7.1.1
CVE-2023-35978
6.1
0%
Jul 5
A vulnerability in ArubaOS could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based…
Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2023-35971
6.1
1%
Jul 5
A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against a user…
Affected: 6.5.4.0 before 8.6.0.21; 8.7.0.0 before 8.10.0.7; 8.11.0.0 before 8.11.1.1; 10.4.0.0 before 10.4.0.2
CVE-2022-37896
6.1
1%
Oct 7
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a…
Affected: 10.3.0.0 before 10.3.1.1
CVE-2019-5314
6.1
1%
Sep 13
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS
Affected: before 6.4.4.20; 6.5.4.0 before 6.5.4.11; 6.5.4.12 before 8.2.1.0; 8.2.1.1 before 8.3.0.0
CVE-2024-33513
5.9
1%
May 1
Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol
Affected: 8.10.0.0 through 8.10.0.10; 8.11.0.0 through 8.11.2.1; 10.4.0.0 through 10.4.1.0; 10.5.0.0 through 10.5.1.0
CVE-2022-37911
5.5
1%
Dec 12
Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS
Affected: 6.5.4.0 before 6.5.4.23; 8.4.0.0 before 8.6.0.18; 8.7.0.0 before 8.7.1.10; 8.8.0.0 before 8.10.0.0; 10.3.0.0
CVE-2026-44873
5.4
0%
May 12
Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System
Affected: 6.5.4.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2
CVE-2026-23601
5.4
0%
Mar 4
Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise
Affected: 6.5.4.0 through 8.10.0.21; 8.11.0.0 through 8.12.0.6; 8.13.0.0 through 8.13.1.1; 10.3.0.0 through 10.4.1.10; 10.5.0.0 through 10.7.2.2; 10.8.0.0
CVE-2022-37892
5.4
1%
Oct 7
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack…
Affected: 10.3.0.0 before 10.3.1.1
Page 4 of 5 · 233 total
1…345