HPE ArubaOS: 72 vulnerabilities fixed, eight at maximum severity
HPE fixes 72 flaws in AOS-8 and AOS-10: eight maximum-severity RCE and authentication bypass bugs exploitable without login. Fixed versions and mitigations.
On Thursday 22 October 2026 Hewlett Packard Enterprise published bulletin HPESBNW05162 with fixes for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of HPE Aruba Networking, the software running on mobility conductors, controllers, gateways and access points. Eight vulnerabilities are rated maximum severity: they allow remote code execution or authentication bypass without credentials, through low-complexity attacks that require no user interaction (BleepingComputer).
HPE says it is not aware of public exploit code or of active exploitation as of the bulletin date, but urges customers to update as soon as possible «due to the complexity, breadth, and impact» of the vulnerabilities. The Centre for Cybersecurity Belgium relayed the advisory with a call to patch immediately; it was also picked up by the Canadian Centre for Cyber Security (AV26-1079) and INCIBE-CERT (INCIBE-2026-789, importance «critical»).
The eight maximum-severity vulnerabilities
| CVE | Type | Branch |
|---|---|---|
| CVE-2026-79844 | Authentication bypass leading to RCE | AOS-10 |
| CVE-2026-79845 | Authentication bypass in the PAPI protocol | AOS-10 |
| CVE-2026-79846 | Unauthenticated command injection | AOS-8 |
| CVE-2026-79847 | Unauthenticated buffer overflow leading to RCE | AOS-10 |
| CVE-2026-79848 | Unauthenticated SQL injection leading to RCE | AOS-8 |
| CVE-2026-79849 | Unauthenticated SQL injection leading to RCE | AOS-8 |
| CVE-2026-79850 | Authentication bypass leading to RCE | AOS-8 |
| CVE-2026-79851 | Unauthenticated buffer overflow leading to RCE | AOS-10 |
According to INCIBE-CERT, CVE-2026-79844 requires preconditions outside the attacker’s control, while CVE-2026-79850 can grant root permissions. CVE-2026-79845 allows administrative access through PAPI, the proprietary protocol used between access points and controllers, and the modification of configurations and sensitive data.
The other critical vulnerabilities
Besides the eight, the bulletin contains further critical vulnerabilities. From the INCIBE-CERT summary:
- remotely reachable without authentication: command injection via PAPI (CVE-2026-79857 in AOS-8, CVE-2026-79861 in AOS-10), buffer overflows with code execution at elevated privileges (CVE-2026-79859, CVE-2026-79860, CVE-2026-79872), SQL injections leading to operating system commands (CVE-2026-79852, CVE-2026-79854), an SSH authentication bypass in AOS-8 granting administrative privileges (CVE-2026-79855), and a buffer overflow and SQL injection in the AOS-8 PAPI implementation (CVE-2026-79856, CVE-2026-79858);
- information disclosure: CVE-2026-79853 in AOS-10, which can facilitate command execution, CVE-2026-79871 in the AOS-10 CLI, reachable remotely without authentication, and CVE-2026-79876 in Wi-Fi frame processing;
- exploitable from an adjacent network: memory corruption with code execution (CVE-2026-79862, CVE-2026-79863, CVE-2026-79865), command injection (CVE-2026-79864), path traversal in PAPI allowing files to be read, modified or deleted (CVE-2026-79866) and a series of authentication bypasses (CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, CVE-2026-79873, CVE-2026-79874, CVE-2026-79875).
The counts by severity differ between sources. SecurityWeek reports 33 critical, 31 high, 8 medium and one low. INCIBE-CERT mentions 74 vulnerabilities (35 critical, 31 high, 7 medium, one low), but includes two PHP flaws published by HPE in the same period for other products (see below); the AOS CVEs it lists as critical number 33, as in SecurityWeek.
The findings come from the HPE Networking internal team and external researchers, including moonv, zzcentury and m0omo0d (INCIBE-CERT). The sources publish no indicators of compromise. Relevant MITRE ATT&CK techniques in case of exploitation: T1190 (Exploit Public-Facing Application) and T1210 (Exploitation of Remote Services) for the adjacent-network vectors.
Affected and fixed versions
Affected products are mobility conductors, controllers, gateways and access points and, according to HPE as quoted by SecurityWeek, also hardware and virtual machines compatible with the vulnerable operating systems.
| Branch | Affected | Fixed |
|---|---|---|
| AOS-10.8 | 10.8.1.1 and earlier | 10.8.1.2 |
| AOS-10.7 | 10.7.2.6 and earlier | 10.7.2.7 |
| AOS-10.4 | 10.4.1.13 and earlier | 10.4.1.14 |
| AOS-8.13 | 8.13.3.0 and earlier | 8.13.3.1 |
| AOS-8.10 | 8.10.0.23 and earlier | 8.10.0.24 |
ClearPass and PHP2Shell
Alongside the AOS bulletin, HPE published information on the two PHP vulnerabilities known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, which affect ClearPass Policy Manager 6.14.1 and 6.11.16 and earlier (INCIBE-CERT). The specific PHP hotfix for 6.14.1 or 6.11.16 is required: upgrading to those base versions alone is not enough. Unsupported versions should be considered vulnerable. HPE Data Management Framework 7, HPE Private Cloud AI and Cray ClusterStor Data Services are also listed, but the general bulletin gives no fixed versions for them.
Impact for European and Italian companies
Wireless controllers handle user authentication, segmentation and network policies: whoever compromises them can move towards internal systems. The vulnerabilities exploitable from an adjacent network also make it important to keep guest networks and user segments separate from management interfaces.
For NIS2 entities the update falls under the vulnerability handling required by the security measures: it is worth documenting inventory, priorities and remediation times. In healthcare, where the wireless network often carries clinical devices too, plan a maintenance window that does not disrupt services.
What to do now
- Inventory conductors, controllers, gateways, access points and VMs running AOS-8 or AOS-10 and check each one’s version.
- Update to the fixed version of your branch from the HPE Networking support portal.
- Restrict management interfaces, as HPE recommends: CLI and web interface on a dedicated segment or VLAN and/or behind firewall rules, with logging of user activity.
- Check that PAPI and the management interfaces are not reachable from the Internet or from guest or user networks.
- ClearPass: install the PHP hotfix and limit public exposure of guest portals.
- Review the logs of controllers and gateways: unexpected administrative access, unplanned configuration changes, new accounts.
How ARXDOME helps
ARX Expose shows which of your company’s services are visible from the Internet, helping you find exposed management interfaces. ARX Watch finds devices without a probe on the network, network equipment included, with their open ports and services, and flags new or unauthorised ones.
Last updated:
