Hewlett Packard Enterprise (HPE) released security updates for 72 vulnerabilities in ArubaOS, the operating system behind Aruba Networking’s enterprise wireless gear: mobility conductors, access points, controllers and gateways. According to BleepingComputer, eight of them are rated maximum severity. All eight can be exploited remotely by someone with no login, through low-complexity attacks that need no user interaction, and they affect multiple AOS-8 and AOS-10 software versions.
The eight flaws, as listed in BleepingComputer’s table: an authentication bypass leading to code execution in AOS-10 (CVE-2026-79844); an authentication bypass in the PAPI protocol of AOS-10 (CVE-2026-79845); an unauthenticated command injection in AOS-8 (CVE-2026-79846); unauthenticated buffer overflows leading to code execution in AOS-10 (CVE-2026-79847 and CVE-2026-79851); unauthenticated SQL injection leading to code execution in AOS-8 (CVE-2026-79848 and CVE-2026-79849); and an authentication bypass leading to code execution in AOS-8 (CVE-2026-79850). HPE said it is not aware of public proof-of-concept code or exploitation in the wild as of the advisory’s release date, but “strongly urged” customers to patch because of the “complexity, breadth, and impact” of the flaws.
How to check if you’re affected
Affected products are Aruba Networking devices running ArubaOS 8 or ArubaOS 10 software: mobility conductors, access points, controllers and gateways. BleepingComputer’s report did not list the affected or fixed version numbers, and HPE’s advisory page is rendered with JavaScript, so we did not read its tables. Use the advisory (HPE document hpesbnw05162en_us) to match your version against the fixed releases.
- Find your ArubaOS version in the device’s management interface or your Aruba management console, and compare it with the advisory.
- HPE’s interim measure is to restrict the command-line and web management interfaces to a dedicated layer 2 segment or VLAN, or control them with firewall policies at layer 3 and above, with accounting controls to track and log activity.
- BleepingComputer notes that HPE separately warned of critical flaws in ArubaOS-CX (a different switch operating system); we covered that in our September post on CVE-2026-73749.