Skip to content
Hacker Posts

HPE patches eight max-severity ArubaOS RCE and auth-bypass flaws

HPE fixed 72 ArubaOS flaws, eight rated 10.0 — unauthenticated RCE and auth bypass in AOS-8 and AOS-10 (CVE-2026-79844 to -79851). No known exploitation yet; patch now.

Published 3 min read
cvehpearubaadvisoryrce

HPE patched 72 ArubaOS vulnerabilities, eight of them rated maximum severity, in a security bulletin covered by Bleeping Computer on Oct 23. ArubaOS (AOS) is the operating system on Aruba enterprise WLAN controllers and gateways. The eight top flaws are unauthenticated remote code execution and authentication bypass, exploitable remotely through low-complexity attacks with no user interaction. HPE's advisory is hpesbnw05162.

The eight max-severity flaws

Per the HPE advisory via Bleeping Computer:

  • CVE-2026-79844 — authentication bypass leading to RCE (AOS-10).
  • CVE-2026-79845 — authentication bypass in the PAPI protocol (AOS-10).
  • CVE-2026-79846 — unauthenticated command injection (AOS-8).
  • CVE-2026-79847 — unauthenticated buffer overflow leading to RCE (AOS-10).
  • CVE-2026-79848 — unauthenticated SQL injection leading to RCE (AOS-8).
  • CVE-2026-79849 — unauthenticated SQL injection leading to RCE (AOS-8).
  • CVE-2026-79850 — authentication bypass leading to RCE (AOS-8).
  • CVE-2026-79851 — unauthenticated buffer overflow leading to RCE (AOS-10).

Affected and fixed versions

France's CERT-FR tracks the same batch in CERTFR-2026-AVI-1369, which bundles AOS and ClearPass Policy Manager — 74 CVEs by its count, versus the 72 AOS-only figure in HPE's AOS bulletin. The affected AOS branches, and the first fixed build in each, per CERT-FR:

  • 10.4.x before 10.4.1.14
  • 10.7.x before 10.7.2.7
  • 10.8.x before 10.8.1.2
  • 8.10.x before 8.10.0.24
  • 8.13.x before 8.13.3.1

ClearPass Policy Manager is affected below 6.11.16 and 6.14.1. Confirm the exact fixed build against HPE bulletins hpesbnw05162 and hpesbnw05171 before scheduling the upgrade.

Exploitation status

HPE said it had found no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the advisory's release, and was not aware of public discussion of exploit code for the listed flaws.

What to do today

  1. Inventory your AOS-8 and AOS-10 controllers and gateways, and your ClearPass Policy Manager version.
  2. Upgrade to the fixed branches above (AOS 10.4.1.14 / 10.7.2.7 / 10.8.1.2 / 8.10.0.24 / 8.13.3.1; ClearPass 6.11.16 / 6.14.1), confirming the build in the HPE bulletin.
  3. Until patched, restrict access to the controller management interfaces and the PAPI protocol to trusted segments. The unauthenticated flaws need network reach to the device, so the management plane is the thing to fence off first.
  4. Hunt for anomalous access to management services on these devices while you schedule the upgrade.

Context

This is a fresh ArubaOS and ClearPass batch, distinct from the Aruba Instant On advisories earlier in 2026. Network-edge gear from the major vendors — controllers, VPN concentrators, orchestrators — keeps drawing unauthenticated RCE research because a single reachable device fronts the whole network. Eight 10.0-rated flaws in one OS release is a large patch; prioritize any AOS device that terminates untrusted traffic.

Related stories