Skip to content
Hacker Posts

HPE patches 8 max-severity RCE and auth-bypass flaws in Aruba AOS

HPE fixed 72 vulnerabilities in Aruba networking, including eight max-severity bugs (CVE-2026-79844 to -79851) in AOS-8 and AOS-10 allowing unauthenticated RCE and auth bypass.

Published 3 min read
cvehpearubaadvisoryrce

HPE has released patches for 72 vulnerabilities across its Aruba networking line, eight of them rated maximum severity. The worst — CVE-2026-79844 through CVE-2026-79851 — let unauthenticated attackers reach remote code execution and bypass authentication for administrative control of affected devices. Fixes are out; HPE says it is not aware of any exploitation yet. If you run Aruba WLAN infrastructure, this is a this-week patch.

What's affected

The flaws hit HPE Aruba networking products running the AOS-8 and AOS-10 wireless operating systems — the software that runs on conductors, controllers, gateways, access points, and virtual-machine deployments. Of the 72 total vulnerabilities in HPE's bulletin, the breakdown is 33 critical, 31 high, 8 medium, and 1 low.

The eight max-severity bugs are:

Between them they allow unauthenticated RCE, authentication bypass for administrative privileges, arbitrary command execution, and full system compromise. The remaining critical issues cover unauthenticated RCE, information disclosure, authentication bypass, file tampering, and administrative access.

Fixes

HPE's security bulletin (advisory ID hpesbnw05162en_us) ships the fixes in AOS 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2, which address all eight max-severity bugs. Machine-readable advisory data is also published in HPE's Aruba CSAF feed. Apply the build matching your branch.

Exploitation status

HPE says it is not aware of any of these vulnerabilities being exploited in the wild, and there is no public exploit code or discussion tied to them as of the advisory's release.

Action checklist

  1. Patch to the fixed AOS build on your branch (8.10.0.24 / 8.13.3.1 / 10.4.1.14 / 10.7.2.7 / 10.8.1.2). Prioritize controllers, conductors, and gateways with exposed management interfaces.
  2. Lock down management access in the meantime: HPE recommends restricting the CLI and web management interfaces to a dedicated layer-2 segment or VLAN, with layer-3 firewall policies controlling access.
  3. Check whether any Aruba management plane is internet-reachable. An unauthenticated-RCE/auth-bypass combination on an exposed WLAN controller is the kind of flaw that gets mass-scanned once a PoC appears.
  4. Enable accounting/logging on management interfaces to capture administrative actions, per HPE's guidance.

Context

Network-infrastructure gear keeps landing in the max-severity-RCE column: the management plane is the crown jewel, and when an unauthenticated attacker can bypass auth on a wireless controller, every downstream AP and client segment is in scope. HPE's own guidance — segment the management interface onto its own VLAN behind an L3 firewall — is the durable fix here regardless of this specific patch cycle, because the next AOS advisory will land the same way.

Related stories