CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product arubanetworks:arubaos. Show all products

81 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2026-44871High 8.8Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44874Medium 4.9A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system.May 12, 2026
CVE-2026-44873Medium 5.4A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled.May 12, 2026
CVE-2026-44872High 7.2A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44870High 8.8Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44869High 8.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44868High 8.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44867High 8.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44866High 8.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44865High 7.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44864High 7.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.May 12, 2026
CVE-2026-44863High 7.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.May 12, 2026
CVE-2026-44862High 7.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.May 12, 2026
CVE-2026-44861High 7.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.May 12, 2026
CVE-2026-44860High 7.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.May 12, 2026
CVE-2026-44859High 7.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44858High 7.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44857High 7.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44856High 7.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44855High 7.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44854High 7.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44853High 7.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-44852High 7.2An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface.May 12, 2026
CVE-2026-23827High 7.5A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution.May 12, 2026
CVE-2026-23826High 7.5A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to…May 12, 2026
CVE-2026-23825High 7.5Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-23824High 7.5Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.May 12, 2026
CVE-2026-23823High 7.2A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection.May 12, 2026
CVE-2026-23822Medium 5.3A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition.May 12, 2026
CVE-2026-23821High 7.2A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions.May 12, 2026
CVE-2026-23820High 7.2A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environme…May 12, 2026
CVE-2026-23819High 8.8A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim…May 12, 2026
CVE-2026-23812Medium 4.2A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique.Mar 4, 2026
CVE-2026-23811Low 3.1A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3).Mar 4, 2026
CVE-2026-23810Low 3.1A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addres…Mar 4, 2026
CVE-2026-23809High 7.6A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs.Mar 4, 2026
CVE-2026-23808High 8.1A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device.Mar 4, 2026
CVE-2026-23601Medium 5.4A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions.Mar 4, 2026
CVE-2025-37179Medium 5.3Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers.Jan 13, 2026
CVE-2025-37178High 7.5Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers.Jan 13, 2026
CVE-2025-37177Medium 6.5An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37176High 7.2A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations.Jan 13, 2026
CVE-2025-37175High 7.2Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37174High 7.2Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37173High 7.2An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems.Jan 13, 2026
CVE-2025-37172High 7.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37171High 7.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37170High 7.2Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system.Jan 13, 2026
CVE-2025-37169High 7.2A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway.Jan 13, 2026
CVE-2025-37168Critical 9.1Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system.Jan 13, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.