HPE Aruba Networking ArubaOS · Disclosed

HPE patches 8 CVSS 10 pre-auth RCE flaws in ArubaOS

Nov 03, 2026 · 1 min read

HPE released advisory HPESBNW05162 on Oct 22, 2026, fixing 72 vulnerabilities in ArubaOS (AOS-8 and AOS-10), the system that runs Aruba Mobility Conductors, Controllers, Gateways and Access Points. Eight maximum-severity flaws (CVE-2026-79844 to CVE-2026-79851) allow remote code execution with no login, via authentication bypass, command injection, SQL injection and buffer overflows. HPE says it is not aware of public exploit code; update to AOS-10 10.8.1.2, 10.7.2.7, 10.4.1.14 or AOS-8 8.13.3.1, 8.10.0.24.

By HIFY Radar newsroom Updated 11/03/2026 05:19 AM Get this every day →← Back to the feed 1 source

CriticalVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

HPE fixed 72 vulnerabilities in ArubaOS, the system running Aruba wireless equipment such as controllers, gateways and access points. Eight maximum-severity flaws let an attacker take over a device remotely without credentials. Fixes were released on Oct 22, 2026.

Why it matters

These devices sit at the core of enterprise networks: a no-login takeover is a direct path into the internal network, per the source's analysis. Any company running Mobility Conductors, Controllers, Gateways or Access Points on AOS-8 or AOS-10 is exposed, and end-of-maintenance releases are presumed affected.

What to do

Update immediately to AOS-10 10.8.1.2, 10.7.2.7, 10.4.1.14 or AOS-8 8.13.3.1, 8.10.0.24. Until then, restrict management access (CLI, web and PAPI) to a dedicated management VLAN or firewall-controlled segment.

For the technical team

CVE: CVE-2026-79844, CVE-2026-79851
Affected: HPE Aruba Networking ArubaOS (AOS-8 e AOS-10), sistema que roda em Mobility Conductors, Controllers, Gateways e Access Points · AOS-10.8.1.1, 10.7.2.6, 10.4.1.13, AOS-8.13.3.0, 8.10.0.23 and below. End-of-maintenance releases are presumed affected.
Exploitation: No known exploitation: HPE says it is not aware of public exploit code or discussion of the flaws. No PoC reported.
Fix: Fixed versions: AOS-10 10.8.1.2, 10.7.2.7, 10.4.1.14 and AOS-8 8.13.3.1, 8.10.0.24. Mitigation until patched: restrict CLI, web management and PAPI access to a dedicated management VLAN or firewall-controlled segment.
Vector: ArubaOS (AOS-8 and AOS-10) on Mobility Conductors, Controllers, Gateways and Access Points. Authentication bypass, command injection, SQL injection and buffer overflow flaws lead to pre-authentication RCE. Interfaces cited for mitigation: CLI, web management and PAPI.
More details: Advisory HPESBNW05162, published Oct 22, 2026, fixes 72 vulnerabilities in total. The 8 maximum-severity flaws (CVSS 10.0) are CVE-2026-79844 to CVE-2026-79851. Report published by the DailyDarkWeb account based on the HPE advisory.