HPE patches eight maximum-severity flaws in ArubaOS enabling unauthenticated RCE

Hewlett Packard Enterprise (HPE) has released security updates for 72 vulnerabilities in the Aruba Operating System (ArubaOS, or AOS), eight of which are rated maximum severity, BleepingComputer reported on October 23. ArubaOS runs HPE Aruba Networking's enterprise wireless infrastructure, including mobility conductors, access points, controllers and gateways, making the flaws relevant to a large number of corporate and campus networks.

What happened

According to BleepingComputer, the eight critical vulnerabilities affect multiple AOS-8 and AOS-10 versions and can be exploited by remote, unauthenticated attackers in low-complexity attacks that require no user interaction. HPE urged customers to install the updates as soon as possible, citing "the complexity, breadth, and impact of these vulnerabilities."

Technical details

The maximum-severity flaws listed in HPE's advisory, as reported by BleepingComputer, are:

• CVE-2026-79844 (AOS-10): authentication bypass leading to remote code execution
• CVE-2026-79845 (AOS-10): authentication bypass in the PAPI protocol
• CVE-2026-79846 (AOS-8): unauthenticated command injection
• CVE-2026-79847 (AOS-10): unauthenticated buffer overflow leading to remote code execution
• CVE-2026-79848 and CVE-2026-79849 (AOS-8): unauthenticated SQL injection leading to remote code execution
• CVE-2026-79850 (AOS-8): authentication bypass leading to remote code execution
• CVE-2026-79851 (AOS-10): unauthenticated buffer overflow leading to remote code execution

BleepingComputer's report does not list CVSS scores or the specific affected and fixed version numbers; these are published in HPE's security bulletin hpesbnw05162en_us.

HPE said it has not found public proof-of-concept exploit code and has no evidence of in-the-wild exploitation, stating that it "is not aware of any public discussion or exploit code" targeting the flaws as of the advisory's release.

Who is affected

Organizations running HPE Aruba Networking mobility conductors, controllers, gateways and access points on vulnerable AOS-8 or AOS-10 releases are affected. Network equipment of this kind has frequently been targeted by attackers once patches are released and the changes can be studied, which makes rapid patching important even in the absence of known exploitation.

What to do

• Review HPE bulletin hpesbnw05162en_us to identify affected AOS-8 and AOS-10 releases and upgrade to the fixed versions as soon as possible.
• Until updates are applied, HPE recommends restricting the CLI and web management interfaces to a dedicated layer 2 segment or VLAN.
• Control access to management interfaces with layer 3 and above firewall policies.
• Enable accounting controls to track and log user activity and resource usage, which can help detect suspicious access.

The update follows other recent HPE advisories, including critical AOS-CX flaws that could allow administrator password resets and remote code execution, BleepingComputer noted.