Loading story…
Hewlett Packard Enterprise (HPE) released security updates for multiple products, including HPE Aruba Networking AOS-CX and HPE Telco Intelligent Assurance, and the Canadian Centre for Cyber Security amplified the guidance to review HPE advisories and apply the required patches. The Aruba AOS-CX updates address multiple issues in the switch OS, with reporting highlighting a critical authentication bypass in the web management interface that can allow an unauthenticated remote attacker to bypass authentication controls and, in some cases, reset the admin password (tracked as CVE-2026-23813). HPE stated it was not aware of public exploit code or active exploitation at the time of advisory publication.
For HPE Telco Intelligent Assurance, HPE disclosed an arbitrary code execution risk tied to its deployment of Apache Avro when generating specific records from untrusted Avro schemas (CVE-2025-33042, CVSS 3.1 base score 7.3). HPE indicated the affected Avro Java SDK versions include all versions through 1.11.4 and 1.12.0, with fixes available in 1.11.5 or 1.12.1; HPE Telco Intelligent Assurance remediation is provided via upgrading to FAS 4.2.14 / PDO 4.2.14. Where immediate patching is not possible for Aruba AOS-CX, mitigations include restricting management-plane access (e.g., dedicated management VLAN/segment), enforcing L3 policies and control-plane ACLs, disabling unnecessary HTTP(S) exposure on SVIs/routed ports, and increasing logging/monitoring of management interface activity.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-10, the Canadian Centre for Cyber Security published advisory AV26-217 highlighting HPE’s March 9 security bulletins for Aruba AOS-CX and HPE Telco Intelligent Assurance. It urged administrators to review the advisories and apply the necessary updates.
HPE released fixes for multiple Aruba AOS-CX vulnerabilities, including critical authentication bypass CVE-2026-23813 that could let an unauthenticated remote attacker reset the admin password through the web management interface. HPE also published mitigation guidance such as isolating management access, restricting trusted hosts, disabling unnecessary HTTP(S), and enforcing ACLs, and said it was not aware of public exploit code or in-the-wild exploitation at release.
On 2026-03-09, HPE published security advisories covering multiple products, including Aruba Networking AOS-CX vulnerabilities and HPESBNW05022 rev.1 for HPE Telco Intelligent Assurance. The Telco Intelligent Assurance bulletin states affected versions are prior to FAS 4.2.14 and prior to PDO 4.2.14.
The critical Aruba AOS-CX authentication bypass vulnerability CVE-2026-23813 was reported to HPE by the researcher "moonv" via HPE Aruba Networking’s bug bounty program. The exact disclosure date is not provided in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecsoonline.com
Open sourcecyber.gc.ca
Open sourcesupport.hpe.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hewlett Packard Enterprise (**HPE Aruba Networking**) disclosed and patched multiple high-severity vulnerabilities affecting *Aruba Networking Instant On* access points/routers, warning that devices running software `3.3.1.0` and earlier are exposed to **information disclosure** and **denial-of-service (DoS)** conditions. The most notable issues include **CVE-2025-37165** (CVSS 7.5), which can expose VLAN and other internal network configuration details via unintended interfaces when operating in router mode, and **CVE-2025-37166** (CVSS 7.5), where specially crafted packets can drive devices into a non-responsive state that may require a hard reset to restore service. HPE also addressed kernel-level packet-processing weaknesses (**CVE-2023-52340** and **CVE-2022-48839**) tied to IPv4/IPv6 handling that can lead to memory corruption and service disruption. Separately, HPE Aruba issued an advisory for **ArubaOS AOS-8 and AOS-10** used by Mobility Conductors, Controllers, and Gateways, patching a broader set of vulnerabilities spanning authenticated command injection and web-interface flaws. The highest-impact item highlighted is **CVE-2025-37168** (CVSS 8.2), an **unauthenticated arbitrary file deletion** vulnerability in AOS-8 Mobility Conductors that can delete critical files and trigger a DoS condition; additional fixes include an authenticated web management interface stack overflow in AOS-10 (**CVE-2025-37169**) that can enable privileged code execution, plus multiple authenticated command injection and file upload/write issues across AOS-8/AOS-10.
Jun 29, 2026
HPE issued security advisories covering multiple vulnerabilities in **HPE Telco Network Function Virtualization Orchestrator** and **HPE Aruba Networking ArubaOS-CX Switches**, including critical issues affecting Telco NFV Orchestrator `7.6.0` and earlier. The ArubaOS-CX advisories affect several software branches, including `10.16.1000` and earlier, `10.15.0005` and earlier, and `10.13.1080` and earlier, prompting guidance for customers to review vendor bulletins and deploy updates. The disclosures also include bulletin **`HPESBNW05062 rev.1`**, which addresses the status of the **OpenSSH Keystroke Obfuscation Bypass** vulnerability, tracked as **`CVE-2024-39894`**, on ArubaOS-CX. Canada’s Centre for Cyber Security echoed the HPE notice and urged administrators to consult the linked advisories and apply the recommended remediations to affected networking and orchestration platforms.
Jun 29, 2026
Hewlett Packard Enterprise released security updates for multiple vulnerabilities in **HPE Aruba Networking** access points running **Instant AOS-8** and **AOS-10**, including two critical flaws that can lead to remote code execution. The most severe issues, tracked as `CVE-2024-42509` and `CVE-2024-47460`, affect the CLI service and can be exploited by an unauthenticated attacker by sending specially crafted packets to **UDP port 8211**, where the **PAPI** management protocol listens, enabling command injection and code execution on vulnerable devices. HPE also addressed four additional high-severity vulnerabilities — `CVE-2024-47461`, `CVE-2024-47462`, `CVE-2024-47463`, and `CVE-2024-47464` — that could allow a remote authenticated attacker to execute code or access sensitive information. HPE advised organizations to upgrade to fixed **AOS-10** and **Instant AOS-8** releases immediately, restrict exposure of management interfaces if patching cannot be completed at once, and replace Aruba products that have reached end of support.
Jul 24, 2026