High · published September 2, 2026
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
| Product | Versions | Fixed in |
|---|---|---|
| hpe/arubaos-cx | ≤ 10.10.1180 | — |
| hpe/arubaos-cx | ≥ 10.13.0000, ≤ 10.13.1180 | — |
| hpe/arubaos-cx | ≥ 10.16.0000, ≤ 10.16.1051 | — |
| hpe/arubaos-cx | ≥ 10.17.0000, ≤ 10.17.1021 | — |
| hpe/arubaos-cx | all versions | — |