Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via...

Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...

CVE-2026-73782

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-73770

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute...

CVE-2026-73767

Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73753

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73751

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

CVE-2026-73770

CVE-2026-73770 is an authenticated arbitrary file write vulnerability in AOS-CX (HPE ArubaOS for campus switching). A malicious actor with authenticated access can, under specific conditions outside their control and requiring action by another user, create or modify arbitrary files and execute c...

EUVD-2026-69633

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute...

CVE-2026-73770 Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the attacker's control and following a required action by another user, to create or modify arbitrary files and execute...

CVE-2026-73767 Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

EUVD-2026-69631

Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities results in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73767

Authenticated command injection vulnerabilities exist in the command line interface (CLI) of HPE AOS-CX (ArubaOS-CX). Successful exploitation allows an attacker with authenticated access to execute arbitrary commands as a privileged user on the underlying operating system. The CNA-assigned CVSS 3...

CVE-2026-73766 Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...

EUVD-2026-69630

Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...

CVE-2026-73766

CVE-2026-73766 is a command injection vulnerability in the API endpoint of HPE AOS-CX . An authenticated remote attacker with administrative privileges can inject arbitrary commands, potentially executing them as a privileged user on the underlying operating system. The HPE-assigned CVSS 3.1 scor...

CVE-2026-73766 Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...

CVE-2026-73753 Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-73751

CVE-2026-73751 is an authenticated remote command injection in the AOS-CX (Aruba) web-based management interface, assigned by HPE . An authenticated user with low-privileged access can submit crafted input through the web interface to execute arbitrary commands on the underlying operating system,...

CVE-2026-73720

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...