HPE patches 72 ArubaOS flaws, eight rated maximum severity for unauthenticated remote code execution or authentication bypass

TLDR

• HPE patched 72 ArubaOS flaws, eight rated maximum severity, affecting AOS-8 and AOS-10 wireless controllers, gateways and access points.¹²
• The eight can be exploited remotely without privileges or user interaction; HPE knows of no public exploit code.¹²
• Fixed releases include AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24; HPE advises restricting management interfaces.¹²

Hewlett Packard Enterprise has released security updates for 72 vulnerabilities in ArubaOS (AOS), the operating system behind Aruba Networking's enterprise wireless mobility conductors, controllers, gateways and access points.¹² Eight are rated at the maximum severity, and BleepingComputer reports they affect multiple AOS-8 and AOS-10 versions and can be exploited by remote attackers without privileges, through low-complexity attacks that need no user interaction.¹ They include authentication bypasses leading to code execution in both AOS-10 and AOS-8, unauthenticated buffer overflows leading to code execution in AOS-10, unauthenticated SQL injection leading to code execution in AOS-8 and an unauthenticated command injection in AOS-8 (CVE-2026-79844 to CVE-2026-79851).¹

Rescana, quoting HPE's bulletin HPESBNW05162 dated 22 October, says HPE scores all eight 10.0 on CVSS 3.1 and rates 33 of the 72 flaws Critical.² HPE says two of the eight, CVE-2026-79844 and CVE-2026-79846, could allow command execution "if certain preconditions outside of the attacker's control are met", without saying what those preconditions are, according to Rescana.² Rescana lists the fixed versions as AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14, and AOS-8.13.3.1 and 8.10.0.24, or later.²

HPE says it is not aware of any public discussion or exploit code targeting the flaws as of the advisory's release, and BleepingComputer reports HPE has found no evidence that they are being exploited in the wild.¹² Rescana adds that, as of 23 October, none of the 72 flaws was in CISA's Known Exploited Vulnerabilities catalogue.² HPE says the flaws were generally found by its internal security research.² Its advisory urges customers to patch "due to the complexity, breadth, and impact of these vulnerabilities" and recommends restricting the command-line and web management interfaces to a dedicated layer 2 segment or VLAN, or controlling them with firewall policies at layer 3 and above, with accounting controls to track activity.¹ Rescana says HPE names UDP port 8211 for the PAPI protocol, in which several of the flaws sit.²

Why it matters: the flaws sit in the controllers and gateways that run enterprise Wi-Fi and are reachable without credentials, so operators of AOS-8 and AOS-10 should patch and put management interfaces behind restricted networks before exploit code appears.¹²