彙總 HPE 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
已披露問題常與 跨站腳本、開放重定向與輸入驗證問題 相關，可能在 軟體部署與生產負載 場景中帶來 工作階段劫持與異常行為 等暴露風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2026-23818 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulnerability in the login flow using a crafted URL. Successful exploitation may redirect an authenticated user to an attacker-controlled server hosting a spoofed login page prompting the unsuspecting victim to give away their credentials, which could then be captured by the attacker, before being redirected back to the l | [email protected] | 8.8 | 0.32% | 2026-04-07 | 2026-06-17 |
| CVE-2026-23817 | A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL. | [email protected] | 6.5 | 0.29% | 2026-03-11 | 2026-06-17 |
| CVE-2026-23598 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities. | [email protected] | 6.5 | 0.33% | 2026-02-17 | 2026-06-17 |
| CVE-2026-23597 | Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities. | [email protected] | 6.5 | 0.25% | 2026-02-17 | 2026-06-17 |
| CVE-2026-23596 | A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability. | [email protected] | 6.5 | 0.24% | 2026-02-17 | 2026-06-17 |
| CVE-2026-23595 | An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data. | [email protected] | 8.8 | 0.30% | 2026-02-17 | 2026-06-17 |
| CVE-2025-37164 KEV | A remote code execution issue exists in HPE OneView. | [email protected] | 10.0 | 89.73% | 2025-12-16 | 2026-06-17 |
| CVE-2025-37160 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploitation of this vulnerability could enable the attacker to disclose sensitive data. | [email protected] | 5.3 | 0.26% | 2025-11-18 | 2026-06-17 |
| CVE-2025-37159 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active user session. Successful exploitation may enable the attacker to maintain unauthorized access to the session, potentially leading to the view or modification of sensitive configuration data. | [email protected] | 5.8 | 0.26% | 2025-11-18 | 2026-06-17 |
| CVE-2025-37158 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system. | [email protected] | 6.7 | 0.67% | 2025-11-18 | 2026-06-17 |
| CVE-2025-37157 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remote Code Execution (RCE) on the affected system. | [email protected] | 6.7 | 0.67% | 2025-11-18 | 2026-06-17 |
| CVE-2025-37156 | A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker with administrative access to execute specific code that renders the switch non-bootable and effectively non-functional. | [email protected] | 6.8 | 0.25% | 2025-11-18 | 2026-06-17 |
| CVE-2025-37155 | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If successfully exploited, this vulnerability could allow an attacker with read-only privileges to gain administrator access on the affected system. | [email protected] | 7.8 | 0.10% | 2025-11-18 | 2026-06-17 |
| CVE-2025-37107 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. | [email protected] | 7.3 | 0.41% | 2025-07-16 | 2026-06-17 |
| CVE-2025-37106 | An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. | [email protected] | 7.3 | 0.41% | 2025-07-16 | 2026-06-17 |
| CVE-2025-37105 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18. | [email protected] | 7.5 | 0.58% | 2025-07-16 | 2026-06-17 |
| CVE-2024-51770 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. | [email protected] | 7.5 | 0.36% | 2025-07-14 | 2026-06-17 |
| CVE-2024-51769 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. | [email protected] | 7.5 | 0.36% | 2025-07-14 | 2026-06-17 |
| CVE-2024-51768 | An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. | [email protected] | 8.0 | 0.37% | 2025-07-14 | 2026-06-17 |
| CVE-2024-51767 | An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. | [email protected] | 7.3 | 1.14% | 2025-07-14 | 2026-06-17 |