Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

AOS-8 Mobility Conductors: Unauthorized File Deletion Risk

CVE-2025-37168 · published 9 months ago
Summary

An attacker can remotely delete any file on an AOS-8 system, causing the system to become unavailable. This is a serious issue because it could lead to significant disruptions to business operations. Affected organizations should update their AOS-8 systems as soon as possible to fix this vulnerability.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
arubanetworks arubaos >= 6.5.4.0, < 8.10.0.21
>= 8.11.0.0, < 8.13.1.1
>= 10.3.0.0, < 10.4.1.10
>= 10.5.0.0, < 10.7.2.2
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
Original advisory text
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an u...
Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and potentially result in denial-of-service conditions on affected devices.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-552Files or Directories Accessible to External Parties
Timeline
Published13 Jan 2026
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-37168 · NVD
Track software like this
Free during beta