60
Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise
HPE patched critical EdgeConnect SD-WAN flaws, including CVSS 9.8 unauthenticated API bypass and gateway RCE, enabling full system compromise.
HPE Security Bulletin HPESBNW05135 covers critical flaws in EdgeConnect SD-WAN Orchestrator and Gateways: CVE-2026-76669 and CVE-2026-76670 (CVSS 9.9 authorization bypass/privilege escalation), CVE-2026-76672 (CVSS 9.9, leaks third-party API tokens and credentials), CVE-2026-76673 (CVSS 9.8, unauthenticated Orchestrator API authentication bypass granting administrative privileges), and CVE-2026-76674 (CVSS 9.8, unauthenticated buffer overflow enabling arbitrary code execution on gateways). Fixes are available in ECOS 9.7.1.0/9.6.4.0/9.5.9.0/9.4.9.0 and Orchestrator 9.7.1/9.6.4/9.5.9/9.4.11 or later. HPE reported no public exploit code or active exploitation at publication and recommends isolating management interfaces on a dedicated VLAN.
70
60
42
60
60
60
47
CVE-2026-73749: HPE ArubaOS-CX RCE
HPE patched CVE-2026-73749, a critical unauthenticated remote code execution flaw in ArubaOS-CX network switch software; affected devices need prompt updates.
HPE released patches for CVE-2026-73749, a critical unauthenticated remote code execution vulnerability in HPE Aruba Networking AOS-CX switch operating system. Published details are limited, but the flaw allows unauthenticated attackers to execute code on affected AOS-CX devices. Administrators running ArubaOS-CX should prioritize applying HPE's update.
55
60
60
35
47
60
47
HPE Issues Security Patch for StoreOnce Bug Allowing Remote Authentication Bypass
60
HPE Issues Critical Security Patches for Aruba Access Point Vulnerabilities
60
42
55
30
60
60
New Critical AMI BMC Vulnerability Enables Remote Server Takeover and Bricking
60
60
30
55
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
60
60
42
60
47
55
60
30
57
47
55
30