HPE Patches 72 Aruba Wireless Flaws, Eight Rated a Maximum 10.0

Hewlett Packard Enterprise has released fixes for 72 security flaws in the operating systems behind its enterprise wireless networks, and eight of them carry the maximum severity score of 10.0. The flaws affect the AOS-8 and AOS-10 software that runs HPE’s Mobility Conductors, controllers, gateways and access points, according to HPE’s security advisory, published on 22 October.

HPE says it is not aware of any public exploit code or attacks targeting the flaws, most of which its own researchers found. It is still telling customers to move quickly. “Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities,” the advisory says.

What HPE fixed

The advisory, HPESBNW05162, covers software HPE now calls its HPE Networking wireless operating systems. BleepingComputer, which reported the update on 23 October, describes it by its longer-standing name, the Aruba Operating System or ArubaOS, which powers Aruba Networking enterprise wireless gear.

Eight CVEs are rated 10.0 under CVSS 3.1. On the AOS-10 side, HPE lists an authentication bypass that could let an unauthenticated remote attacker run commands “if certain preconditions outside of the attacker’s control are met” (CVE-2026-79844), and authentication bypasses in AOS-10’s PAPI protocol that could give an attacker administrative access (CVE-2026-79845). Two buffer-overflow issues could allow remote code execution by sending crafted packets (CVE-2026-79847 and CVE-2026-79851).

On AOS-8, the 10.0-rated entries are unauthenticated command injection (CVE-2026-79846), unauthenticated SQL injection that could lead to command execution (CVE-2026-79848 and CVE-2026-79849), and an authentication bypass leading to remote code execution (CVE-2026-79850). The remaining 64 CVEs range from critical to low severity.

The record for the first of these flaws is now live in the CVE database, where HPE published it at 20:04 BST on 22 October. CISA has added its own assessment to the record: exploitation “none”, but the flaw is automatable and its technical impact “total”. The US National Vulnerability Database has received the record but has not yet analysed it.

HPE credits most of the findings to internal security research. Two of the SQL injection flaws were also reported through its bug bounty programme.

Which versions are affected

The advisory lists five supported release branches. The fixed versions are:

The affected products are Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 access points and AOS-8 Instant access points. Fixed releases are available from HPE’s Networking Support Portal.

HPE says versions that have reached end of maintenance are presumed to be affected and are not covered by the advisory. For versions past end of support, it says it has not assessed exposure, so “such installations should be considered potentially impacted”. It advises customers on those releases to upgrade to a supported version.

What to do before the upgrade

For networks that cannot be updated straight away, HPE gives one interim measure: lock down who can reach the management interfaces. “HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage,” the advisory says.

The update lands in a busy week for security fixes. Arista fixed a VeloCloud Orchestrator flaw that was already under attack, GitLab patched a second 10.0-rated flaw in ten days, and Oracle’s October update shipped 1,295 patches.

Unauthenticated access makes the management plane the first thing to lock down

Every one of the eight 10.0 flaws can be triggered over the network, without credentials and without anyone clicking anything, according to the scoring HPE published. That combination is what pushes a score to the top of the scale. It also explains why HPE’s interim advice focuses on the management plane rather than on the wireless traffic itself.

Controllers and conductors are where an organisation’s wireless policy lives: which networks exist, who can join them and how traffic is routed. An attacker with administrative access there can do far more than eavesdrop on one access point. Restricting the command line and web interfaces to a dedicated management VLAN, behind firewall rules, shrinks the set of machines that can even reach the vulnerable code. For many networks it is also ordinary good practice that should already be in place.

That makes the workaround a useful audit as well as a stopgap. Any team that finds its controller management pages reachable from a general office network, or from the internet, has a problem that predates this advisory and will outlast it. Logging and accounting controls, the other half of HPE’s advice, give defenders a record to check if something does go wrong before the upgrade lands.

Unsupported AOS releases carry the largest unknown risk

The fixed-version table only helps customers on one of the five supported branches. HPE is explicit that it has not checked older releases, and says they should be treated as potentially affected. In practice, that means any organisation running an out-of-support AOS version has no patch to apply for these flaws and no assurance that it is safe.

Network equipment can stay in service for years once it is working, and older deployments are the ones most likely to fall outside the supported branches. For them, the realistic path is an upgrade to a supported release, which can involve compatibility checks and hardware limits, rather than a quick point update.

There is a reassuring side to the timing. HPE found most of these flaws itself, nobody is known to be exploiting them, and CISA’s assessment on the CVE record agrees that there is no exploitation so far. That gives defenders a head start. Once fixes are public, researchers and attackers can compare old and new code to find what changed, so the window is real but limited. BleepingComputer notes that HPE has also recently warned of critical flaws in its separate AOS-CX switching software, another reason for network teams to keep a full inventory of what they run.

What happens next

HPE’s advisory is at Revision 1, so further details may follow. The next signals to watch are a CISA Known Exploited Vulnerabilities listing, which would mean attacks have started, and NVD’s own analysis of the eight 10.0-rated CVEs. Until then, the work for administrators is to move every controller, gateway and access point onto 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, 8.10.0.24 or a later release.

Sources

• Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-8 and AOS-10), HPESBNW05162, HPE Networking, 22 October 2026
• CVE-2026-79844 record, CVE Program, published 22 October 2026 (with CISA ADP assessment)
• CVE-2026-79844, National Vulnerability Database (status: received)
• HPE patches eight max severity RCE and auth bypass AOS flaws, BleepingComputer, 23 October 2026 (reported)

Related stories

• Arista Patches 9.9-Rated VeloCloud Orchestrator Zero-Day Under Attack
• GitLab Fixes Second 10.0-Rated Regex Code-Execution Flaw in 10 Days
• Oracle Ships 1,295 Security Patches in October, Most for Fusion Middleware
• GitLab Patches CVE-2026-97229, a CVSS 10.0 Flaw That Could Let an Unauthenticated User Run Code Through a Crafted CI/CD Regex