Hewlett Packard Enterprise (HPE) vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Hewlett Packard Enterprise (HPE) flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView Code InjectionExploited since Jan 7, 2026 · CVSS 10

Latest high and critical flaws

• CVE-2026-95713 An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8.High 7 · Oct 22, 2026
• CVE-2026-95712 A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information haHigh 7.1 · Oct 22, 2026
• CVE-2026-95711 An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing aHigh 7.1 · Oct 22, 2026
• CVE-2026-95710 An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attackHigh 7.1 · Oct 22, 2026
• CVE-2026-95709 Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform coHigh 7.2 · Oct 22, 2026
• CVE-2026-95708 Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform coHigh 7.2 · Oct 22, 2026
• CVE-2026-95707 A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code executionHigh 7.2 · Oct 22, 2026
• CVE-2026-95706 Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injectHigh 7.2 · Oct 22, 2026
• CVE-2026-95705 Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injectHigh 7.2 · Oct 22, 2026
• CVE-2026-95704 A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote codeHigh 7.2 · Oct 22, 2026
• CVE-2026-79956 A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlyHigh 7.2 · Oct 22, 2026
• CVE-2026-79955 An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attackHigh 7.5 · Oct 22, 2026
• CVE-2026-79895 Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.High 7.5 · Oct 22, 2026
• CVE-2026-79894 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8.High 7.5 · Oct 22, 2026
• CVE-2026-79893 Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack.High 7.5 · Oct 22, 2026
• CVE-2026-79892 A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code.High 7.8 · Oct 22, 2026
• CVE-2026-79891 A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on tHigh 8.1 · Oct 22, 2026
• CVE-2026-79890 There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets.High 8.1 · Oct 22, 2026
• CVE-2026-79889 Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using speciaHigh 8.1 · Oct 22, 2026
• CVE-2026-79888 A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow.High 8.1 · Oct 22, 2026
• CVE-2026-79887 A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution.High 8.1 · Oct 22, 2026
• CVE-2026-79886 An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8.High 8.2 · Oct 22, 2026
• CVE-2026-79885 An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8.High 8.2 · Oct 22, 2026
• CVE-2026-79884 A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and aHigh 8.2 · Oct 22, 2026
• CVE-2026-79883 A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.High 8.3 · Oct 22, 2026