CVE-2025-37176: medium-severity vulnerability in Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
Authenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 1.4%
A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting the execution of internal operations. Successful exploit could allow an authenticated malicious actor to execute commands with the privileges of the impacted mechanism.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)Related CVEs — Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
In the same product, most dangerous first.
CVE-2026-79861CRITICALUnauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10EPSS 1.7%CVE-2026-79846CRITICALUnauthenticated Command Injection Vulnerabilities in AOS-8EPSS 1.6%CVE-2026-95715MEDIUMUnauthenticated Local Command Injection Vulnerability in AOS-10 Command Line InterfaceEPSS 1.6%CVE-2026-79864CRITICALUnauthenticated Adjacent Command Injection Vulnerability in AOS-10EPSS 1.5%CVE-2026-79857CRITICALUnauthenticated Command Injection Vulnerability in AOS-8 PAPI ProtocolEPSS 1.4%CVE-2025-37171HIGHAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management InterfaceEPSS 1.4%