HPE · Disclosed

HPE Patches Eight Critical Flaws in Aruba AOS-8 and AOS-10

Oct 21, 2026 · 1 min read

HPE published advisory HPESBNW05162 on October 22, 2026, fixing eight maximum-severity CVEs in the Aruba AOS-8 and AOS-10 wireless operating systems. The flaws allow unauthenticated remote code execution, command injection and authentication bypass with administrative access. HPE reports no known exploitation or public exploit code; upgrade to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24.

By HIFY Radar newsroom Updated 10/27/2026 10:21 AM Get this every day →← Back to the feed 4 sources

CriticalVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

HPE issued advisory HPESBNW05162 on October 22, 2026, fixing eight maximum-severity flaws in the Aruba AOS-8 and AOS-10 wireless operating systems. A remote attacker without credentials can run commands and gain administrative control of controllers, gateways and access points. HPE says it is not aware of in-the-wild exploitation.

Why it matters

Flaws in equipment running corporate Wi-Fi could allow full compromise and wireless network outage. The flaws require no credentials, and End-of-Maintenance releases will not receive a fix.

What to do

Upgrade to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1 or 8.10.0.24, matching the branch in use. Until done, restrict CLI and web management to a dedicated VLAN protected by firewall policies.

For the technical team

CVE: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851
Affected: HPE (Aruba Networking) AOS-8 e AOS-10: Mobility Conductors, Controllers, Gateways e Access Points · AOS-10: 10.8.1.1 and below, 10.7.2.6 and below, 10.4.1.13 and below; AOS-8: 8.13.3.0 and below, 8.10.0.23 and below. Products: Mobility Conductors, Mobility Controllers, Mobility Gateways (managed by HPE Central), AOS-10 Access Points and AOS-8 Instant Access Points. End-of-Maintenance releases are presumed affected and get no fix.
Exploitation: No exploitation reported. HPE states it is not aware of public discussion or exploit code as of the advisory date (2026-10-22); SecurityWeek reiterated on 10/27/2026 that there is no in-the-wild exploitation. Discovered by internal security research at HPE Networking.
Fix: Upgrade to AOS-10.8.1.2 and above, 10.7.2.7 and above, 10.4.1.14 and above, 8.13.3.1 and above, or 8.10.0.24 and above, from the HPE Networking Support Portal. HPE mitigation: restrict CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or layer 3+ firewall policies, with accounting controls for tracking and logging.
Vector: Authentication bypass in the affected management interface (CVE-2026-79844) and in the PAPI protocol (CVE-2026-79845), unauthenticated command injection in AOS-8 (CVE-2026-79846) and buffer overflow in AOS-10 via specially crafted packets (CVE-2026-79847). Unauthenticated remote attacker; CVSS v3.1 10.0, vector AV:N/AC:L/PR:N. CVEs 79844 and 79846 depend on preconditions outside the attacker's control.
More details: Advisory HPESBNW05162, status FINAL, revision 1, severity Critical, published 2026-10-22. SecurityWeek reports the updates cover 72 vulnerabilities in total, including 33 critical, 31 high, 8 medium and 1 low. Hardware, VMs and mobility solutions compatible with the affected operating systems are also affected. BleepingComputer and CVE.org also cover the case.

Timeline

10/27/2026 10:20 AM
SecurityWeek reports the eight max-severity flaws in HPE networking products enable remote code execution and authentication bypass.
10/26/2026 01:11 PM
Incident opened.