HPE patches eight maximum-severity flaws in ArubaOS networking devices

Seventy-two vulnerabilities fixed across AOS-8 and AOS-10, including authentication bypass and remote code execution issues

By LineZotpaper

Published23 October 2026

Read Time2 min

Hewlett Packard Enterprise has released security updates addressing 72 vulnerabilities in its Aruba Operating System, including eight maximum-severity flaws that could allow remote attackers to execute code or bypass authentication without requiring credentials or user interaction.

The vulnerabilities affect multiple versions of AOS-8 and AOS-10, the software that powers Aruba Networking's mobility conductors, access points, controllers, and gateways. According to HPE's security advisory, the eight highest-severity issues include authentication bypass leading to remote code execution (CVE-2026-79844, CVE-2026-79850), unauthenticated command injection (CVE-2026-79846), unauthenticated buffer overflows (CVE-2026-79847, CVE-2026-79851), and unauthenticated SQL injection flaws (CVE-2026-79848, CVE-2026-79849).

All eight can be exploited remotely with low complexity and no user interaction. HPE warned customers to patch immediately due to the breadth and impact of the vulnerabilities. "Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," the company said in the advisory.

The company also provided mitigation recommendations, including restricting CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN and controlling access with firewall policies and accounting controls.

HPE noted that it has not observed publicly available exploit code or evidence of active exploitation. The advisory stated that the company is not aware of any public discussion or exploit code targeting these flaws as of the release date.

This is the latest in a series of security patches from HPE. In June 2025 the company fixed critical StoreOnce vulnerabilities involving authentication bypass and remote code execution, and in July 2025 it warned of hardcoded credentials in Aruba Instant On Access Points. In January 2025, CISA flagged a maximum-severity HPE OneView vulnerability as being exploited in attacks. More recently, HPE warned of critical flaws allowing admin password resets and remote code execution on AOS-CX devices.

Analysis

Why This Matters

Enterprises relying on Aruba wireless infrastructure face potential network compromise if these flaws are exploited. The low-complexity, no-authentication attack vector significantly lowers the barrier for attackers.
With over 55,000 enterprise customers including a large share of Fortune 500 companies, the attack surface is substantial.
HPE's strong language urging immediate patching suggests the vendor assesses the risk as critical despite no current evidence of exploitation.

Background

ArubaOS is the operating system used across HPE's Aruba Networking line of enterprise wireless equipment, including access points, controllers, and gateway devices. These products are widely deployed in corporate networks, universities, and government agencies. HPE has a track record of patching critical vulnerabilities in this product line, with similar advisories in 2025 covering StoreOnce, Aruba Instant On, and AOS-CX devices. Federal agencies such as CISA have previously flagged HPE vulnerabilities as exploited in the wild.

Key Perspectives

HPE: The company has released patches and detailed workarounds. It emphasises that restricting management interfaces to isolated network segments is a key mitigation. HPE states it is not aware of active exploitation but urges patching due to the vulnerabilities' severity and breadth.

Enterprise security teams: The vulnerabilities demand prioritised patching because they require no authentication and no user interaction. Organisations that cannot immediately patch are advised to implement network-level restrictions on management interfaces as a compensating control.

Security researchers: The absence of public exploit code does not guarantee safety; attackers may develop exploits privately. The diversity of flaw types (buffer overflows, SQL injection, command injection) across multiple AOS versions suggests a systematic security review may be needed.

What to Watch

Whether proof-of-concept exploits or active attacks emerge in the coming weeks.
Whether CISA or other national cybersecurity agencies add these CVEs to their Known Exploited Vulnerabilities catalog.
The pace of patch adoption among HPE's enterprise customer base.
Future advisories from HPE indicating whether these vulnerabilities were discovered internally or reported externally.

Sources

HPE patches eight max severity RCE and auth bypass AOS flaws · BleepingComputer

Checked

12 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedHPE patched eight maximum-severity flaws in ArubaOS networking devices.BleepingComputer: “Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.”
SupportedThe updates fixed 72 vulnerabilities across AOS-8 and AOS-10.BleepingComputer: “The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions”
SupportedThe eight top-severity flaws could be exploited remotely without privileges, using low-complexity attacks that require no user interaction.BleepingComputer: “they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction.”
Partly supportedThe story's list of CVEs for the eight highest-severity issues omits CVE-2026-79845.BleepingComputer: “CVE-2026-79845 Authentication Bypass in the PAPI Protocol of AOS-10”
SupportedHPE said, “Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.”BleepingComputer: “Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities,”
Partly supportedHPE warned customers to patch immediately because of the vulnerabilities’ breadth and impact.BleepingComputer: “HPE warned customers to patch these security issues as soon as possible”
Partly supportedHPE recommended restricting management interfaces to a dedicated layer 2 segment or VLAN and controlling access with firewall policies and accounting controls.BleepingComputer: “the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls”
SupportedHPE had not found publicly available exploit code or evidence that the vulnerabilities were being exploited in the wild.BleepingComputer: “The company added that it has not yet found publicly available proof-of-concept exploit code or evidence that these vulnerabilities are being exploited in the wild.”
SupportedHPE said it was not aware of public discussion or exploit code targeting the flaws as of the advisory’s release date.BleepingComputer: “HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory,”
SupportedIn June 2025, HPE fixed critical StoreOnce vulnerabilities involving authentication bypass and remote code execution.BleepingComputer: “In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution”
SupportedIn July 2025, HPE warned of hardcoded credentials in Aruba Instant On Access Points.BleepingComputer: “one month later, warned of hardcoded credentials in Aruba Instant On Access Points”
SupportedIn January 2025, CISA flagged a maximum-severity HPE OneView vulnerability as exploited in attacks.BleepingComputer: “In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also flagged a maximum-severity HPE OneView vulnerability as exploited in attacks.”