This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] HPE Aruba Networking fixes 33 vulnerabilities in various products

HPE Aruba Networking fixes 33 vulnerabilities in various products [1][2][3]. The most severe vulnerabilities are listed below. The vulnerability CVE-2025-35991 originally concerns Intel processors [4]. Several AOS-10 and AOS-8 versions (the list is available at [1][2]) are affected by the vulnerabilities but will not receive a fix because they are EoM. Affected products and their fixed versions: Mobility Conductors AOS - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 [1] Mobility Controllers AOS - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 [1] WLAN Gateways AOS (managed via HPE Aruba Networking Central) - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 [1] SD-WAN Gateways AOS (managed via HPE Aruba Networking Central) - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 [1] Access Points AOS-10, AOS-8 Instant - 10.8.0.1, 10.7.2.3, 10.4.1.11, 8.13.1.2, 8.12.0.7, 8.10.0.22 [2] Alletra 4110, 4120, 4140 - 2.80_01-29-2026 [3] ProLiant Gen11 DL110, DL380a, DL560, ML110 - 2.80_01-29-2026 [3] ProLiant Gen11 Server DL320, DL360, DL380, ML350 - 2.80_01-29-2026 [3] Synergy Gen11 480 - 2.80_01-29-2026 [3] Compute Edge Server e930t - 2.80_01-29-2026 [3]

HPE Aruba Mobility Conductors/Controllers, WLAN and SD-WAN Gateways - RCE and DoS (CVE-2026-23827)
CVSS 9.8 (Critical)

An unauthenticated remote attacker is able to execute arbitrary code in the operating system or cause an application crash in Mobility Conductors / Controllers and WLAN / SD-WAN Gateways due to a heap buffer overflow [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 5. 2026.

HPE Aruba Access Points - command injection (CVE-2026-23820)
CVSS 7.2 (High)

An authenticated remote attacker is able to escape the restricted Shell environment in Access Points and execute arbitrary commands in the operating system [2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-23820 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 5. 2026.

HPE Aruba ProLiant DL/ML, Alletra, Synergy, and Edgeline Servers - Information disclosure (CVE-2025-35991)
CVSS 5.3 (Medium)

An authenticated local attacker is able to gain unauthorized access to information on certain ProLiant DL/ML, Alletra, Synergy and Edgeline servers with 4th and 5th generation Intel Xeon processors [3][4]. The list of specific servers is available at [3].

CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 12. 5. 2026.

HPE Aruba Access Points - XSS (CVE-2026-23819)
CVSS 8.8 (High)

An unauthenticated adjacent attacker is able to carry out an XSS attack in Access Points [2].

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

  • CVE-2026-23819 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 5. 2026.

By CESNET, z.s.p.o. Martin Krajči on 13. 5. 2026.

CESNET, z.s.p.o. Logo