Loading story…
HPE published security advisories for multiple vulnerabilities affecting HPE Telco Intelligent Assurance (FAS and PDO) version 4.2.15 and earlier, as well as HPE Unified OSS Console (UOC) and HPE Unified OSS Console Assurance Monitoring (UOCAM) version 3.1.21 and earlier. The issues were disclosed through HPE bulletin entries HPESBNW05076 rev.1 and HPESBNW05080 rev.1, with downstream reporting urging customers to review the vendor notices and identify exposed deployments.
Organizations running the affected platforms have been advised to consult HPE’s Security Bulletin Library and apply the vendor-provided updates or mitigations referenced in the advisories. The notice highlights telecom and OSS environments as the impacted footprint, making patch review and remediation a priority for administrators responsible for assurance, monitoring, and operations support systems.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
A security notice dated July 15, 2026 urged users and administrators to review the linked HPE advisories and apply the necessary updates for the affected products. The notice references the advisories published the previous day.
On July 14, 2026, HPE published security advisories HPESBNW05076 rev.1 and HPESBNW05080 rev.1 addressing multiple vulnerabilities in HPE Telco Intelligent Assurance, HPE Unified OSS Console, and HPE Unified OSS Console Assurance Monitoring. The notice says affected versions include HPE Telco Intelligent Assurance (FAS and PDO) 4.2.15 and earlier, and HPE UOC and UOCAM 3.1.21 and earlier.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HPE issued security advisories for vulnerabilities affecting two telecom orchestration products: **HPE Telco Service Orchestrator** and **HPE Telco Network Function Virtualization Orchestrator**. The first bulletin, `HPESBNW05031 rev.1`, covers multiple vulnerabilities in HPE Telco Service Orchestrator versions prior to **v5.5.1**, while a separate advisory addresses a **critical** flaw in HPE Telco Network Function Virtualization Orchestrator affecting **v7.5.0 and earlier**. The critical issue in HPE Telco Network Function Virtualization Orchestrator was tied to **improper input validation** in the **Undertow HTTP Server Core**. The Canadian Centre for Cyber Security urged organizations using either product to review HPE’s security bulletins and apply the required updates to remediate the exposed versions.
Jul 1, 2026
Hewlett Packard Enterprise (HPE) released security updates for multiple products, including **HPE Aruba Networking AOS-CX** and **HPE Telco Intelligent Assurance**, and the Canadian Centre for Cyber Security amplified the guidance to review HPE advisories and apply the required patches. The Aruba AOS-CX updates address multiple issues in the switch OS, with reporting highlighting a **critical authentication bypass** in the web management interface that can allow an **unauthenticated remote attacker** to bypass authentication controls and, in some cases, **reset the admin password** (tracked as `CVE-2026-23813`). HPE stated it was not aware of public exploit code or active exploitation at the time of advisory publication. For **HPE Telco Intelligent Assurance**, HPE disclosed an **arbitrary code execution** risk tied to its deployment of **Apache Avro** when generating specific records from **untrusted Avro schemas** (`CVE-2025-33042`, CVSS 3.1 base score **7.3**). HPE indicated the affected Avro Java SDK versions include all versions through **1.11.4** and **1.12.0**, with fixes available in **1.11.5** or **1.12.1**; HPE Telco Intelligent Assurance remediation is provided via upgrading to **FAS 4.2.14** / **PDO 4.2.14**. Where immediate patching is not possible for Aruba AOS-CX, mitigations include restricting management-plane access (e.g., dedicated management VLAN/segment), enforcing L3 policies and control-plane ACLs, disabling unnecessary HTTP(S) exposure on SVIs/routed ports, and increasing logging/monitoring of management interface activity.
Jun 29, 2026
HPE issued security advisories covering multiple vulnerabilities in **HPE Telco Network Function Virtualization Orchestrator** and **HPE Aruba Networking ArubaOS-CX Switches**, including critical issues affecting Telco NFV Orchestrator `7.6.0` and earlier. The ArubaOS-CX advisories affect several software branches, including `10.16.1000` and earlier, `10.15.0005` and earlier, and `10.13.1080` and earlier, prompting guidance for customers to review vendor bulletins and deploy updates. The disclosures also include bulletin **`HPESBNW05062 rev.1`**, which addresses the status of the **OpenSSH Keystroke Obfuscation Bypass** vulnerability, tracked as **`CVE-2024-39894`**, on ArubaOS-CX. Canada’s Centre for Cyber Security echoed the HPE notice and urged administrators to consult the linked advisories and apply the recommended remediations to affected networking and orchestration platforms.
Jun 29, 2026