Loading story…
HPE issued security advisories covering multiple vulnerabilities in HPE Telco Network Function Virtualization Orchestrator and HPE Aruba Networking ArubaOS-CX Switches, including critical issues affecting Telco NFV Orchestrator 7.6.0 and earlier. The ArubaOS-CX advisories affect several software branches, including 10.16.1000 and earlier, 10.15.0005 and earlier, and 10.13.1080 and earlier, prompting guidance for customers to review vendor bulletins and deploy updates.
The disclosures also include bulletin HPESBNW05062 rev.1, which addresses the status of the OpenSSH Keystroke Obfuscation Bypass vulnerability, tracked as CVE-2024-39894, on ArubaOS-CX. Canada’s Centre for Cyber Security echoed the HPE notice and urged administrators to consult the linked advisories and apply the recommended remediations to affected networking and orchestration platforms.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On June 2, 2026, HPE published bulletin HPESBNW05062 rev.1 addressing the status of the OpenSSH Keystroke Obfuscation Bypass vulnerability (CVE-2024-39894) on ArubaOS-CX. The advisory covers affected ArubaOS-CX software branches and directs users to review and apply relevant updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HPE issued security advisories for vulnerabilities affecting two telecom orchestration products: **HPE Telco Service Orchestrator** and **HPE Telco Network Function Virtualization Orchestrator**. The first bulletin, `HPESBNW05031 rev.1`, covers multiple vulnerabilities in HPE Telco Service Orchestrator versions prior to **v5.5.1**, while a separate advisory addresses a **critical** flaw in HPE Telco Network Function Virtualization Orchestrator affecting **v7.5.0 and earlier**. The critical issue in HPE Telco Network Function Virtualization Orchestrator was tied to **improper input validation** in the **Undertow HTTP Server Core**. The Canadian Centre for Cyber Security urged organizations using either product to review HPE’s security bulletins and apply the required updates to remediate the exposed versions.
Jul 1, 2026
Hewlett Packard Enterprise (HPE) released security updates for multiple products, including **HPE Aruba Networking AOS-CX** and **HPE Telco Intelligent Assurance**, and the Canadian Centre for Cyber Security amplified the guidance to review HPE advisories and apply the required patches. The Aruba AOS-CX updates address multiple issues in the switch OS, with reporting highlighting a **critical authentication bypass** in the web management interface that can allow an **unauthenticated remote attacker** to bypass authentication controls and, in some cases, **reset the admin password** (tracked as `CVE-2026-23813`). HPE stated it was not aware of public exploit code or active exploitation at the time of advisory publication. For **HPE Telco Intelligent Assurance**, HPE disclosed an **arbitrary code execution** risk tied to its deployment of **Apache Avro** when generating specific records from **untrusted Avro schemas** (`CVE-2025-33042`, CVSS 3.1 base score **7.3**). HPE indicated the affected Avro Java SDK versions include all versions through **1.11.4** and **1.12.0**, with fixes available in **1.11.5** or **1.12.1**; HPE Telco Intelligent Assurance remediation is provided via upgrading to **FAS 4.2.14** / **PDO 4.2.14**. Where immediate patching is not possible for Aruba AOS-CX, mitigations include restricting management-plane access (e.g., dedicated management VLAN/segment), enforcing L3 policies and control-plane ACLs, disabling unnecessary HTTP(S) exposure on SVIs/routed ports, and increasing logging/monitoring of management interface activity.
Jun 29, 2026
Hewlett Packard Enterprise (**HPE Aruba Networking**) disclosed and patched multiple high-severity vulnerabilities affecting *Aruba Networking Instant On* access points/routers, warning that devices running software `3.3.1.0` and earlier are exposed to **information disclosure** and **denial-of-service (DoS)** conditions. The most notable issues include **CVE-2025-37165** (CVSS 7.5), which can expose VLAN and other internal network configuration details via unintended interfaces when operating in router mode, and **CVE-2025-37166** (CVSS 7.5), where specially crafted packets can drive devices into a non-responsive state that may require a hard reset to restore service. HPE also addressed kernel-level packet-processing weaknesses (**CVE-2023-52340** and **CVE-2022-48839**) tied to IPv4/IPv6 handling that can lead to memory corruption and service disruption. Separately, HPE Aruba issued an advisory for **ArubaOS AOS-8 and AOS-10** used by Mobility Conductors, Controllers, and Gateways, patching a broader set of vulnerabilities spanning authenticated command injection and web-interface flaws. The highest-impact item highlighted is **CVE-2025-37168** (CVSS 8.2), an **unauthenticated arbitrary file deletion** vulnerability in AOS-8 Mobility Conductors that can delete critical files and trigger a DoS condition; additional fixes include an authenticated web management interface stack overflow in AOS-10 (**CVE-2025-37169**) that can enable privileged code execution, plus multiple authenticated command injection and file upload/write issues across AOS-8/AOS-10.
Jun 29, 2026