CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,488 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,488
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product arubanetworks:arubaos. Show all products

81 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2022-37897Critical 9.8There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) U…Dec 12, 2022
CVE-2022-37898High 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37899High 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37900High 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37901High 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37902High 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37903High 8.8A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface.Dec 12, 2022
CVE-2022-37904High 8.8Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence.Dec 12, 2022
CVE-2022-37905High 8.8Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence.Dec 12, 2022
CVE-2022-37906High 8.1An authenticated path traversal vulnerability exists in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37907High 7.5A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system.Dec 12, 2022
CVE-2022-37908Medium 6.5An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers.Dec 12, 2022
CVE-2022-37909Medium 5.3Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs.Dec 12, 2022
CVE-2022-37910Medium 6.5A buffer overflow vulnerability exists in the ArubaOS command line interface.Dec 12, 2022
CVE-2022-37911Medium 5.5Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS.Dec 12, 2022
CVE-2022-37912High 8.8Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Dec 12, 2022
CVE-2025-37132High 7.2An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37133High 7.2An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system.Oct 14, 2025
CVE-2025-37134High 7.2An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system.Oct 14, 2025
CVE-2025-37135Medium 6.5Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor.Oct 14, 2025
CVE-2025-37136Medium 6.5Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor.Oct 14, 2025
CVE-2025-37137Medium 6.5Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor.Oct 14, 2025
CVE-2025-37138Medium 6.2An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating system.Oct 14, 2025
CVE-2025-37140Medium 4.9Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37141Medium 4.9Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37142Medium 4.9Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37143Medium 4.9An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37144Medium 4.9Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37145Medium 4.9Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems.Oct 14, 2025
CVE-2025-37161High 7.5A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service.Nov 18, 2025
CVE-2025-37162High 8.8A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack.Nov 18, 2025
CVE-2025-37168Critical 9.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37169High 7.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway.Jan 13, 2026
CVE-2025-37170High 7.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37171High 7.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37172High 7.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37173High 7.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37174High 7.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37175High 7.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37176High 7.2A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations.Jan 13, 2026
CVE-2025-37177Medium 6.5An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37178High 7.5Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers.Jan 13, 2026
CVE-2025-37179Medium 5.3Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers.Jan 13, 2026
CVE-2026-23601Medium 5.4A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions.Mar 4, 2026
CVE-2026-23808High 8.1A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device.Mar 4, 2026
CVE-2026-23809High 7.6A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs.Mar 4, 2026
CVE-2026-23810Low 3.1A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addres…Mar 4, 2026
CVE-2026-23811Low 3.1A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3).Mar 4, 2026
CVE-2026-23812Medium 4.2A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique.Mar 4, 2026
CVE-2026-23819High 8.8A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim…May 12, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.