HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

22 October 2026: Hewlett Packard Enterprise has fixed a group of maximum-severity flaws in AOS-10 and AOS-8, the operating systems of its Aruba wireless access points, gateways and controllers, in security bulletin HPESBNW05162. Seven CVE records published by HPE on 22 October each score 10.0 and describe attacks that need no login: authentication bypass, command injection, SQL injection and buffer overflows, all leading to remote code execution. HPE has said it knows of no public exploit code, according to BleepingComputer.

Not yet independently verified. HPE's bulletin renders only in a browser, so the scores and affected lines come from the CVE records; the total of 72 flaws is as BleepingComputer reports it. We will update this when it can be confirmed, and remove this note.

Fixed releases

The Canadian Centre for Cyber Security lists every version before these as affected:

Line	Fixed release
AOS-10.8	10.8.1.2
AOS-10.6 and 10.7	10.7.2.7
AOS-10.3 and 10.4	10.4.1.14
AOS-8.12 and 8.13	8.13.3.1
AOS-8.10	8.10.0.24

The CVE records give the affected ranges as AOS-10 10.3.0.0 to 10.4.1.13, 10.6.0.0 to 10.7.2.6 and 10.8.0.0 to 10.8.1.1, and AOS-8 8.10.0.0 to 8.10.0.23 and 8.12.0.0 to 8.13.3.0. Older branches outside those ranges are not named, so a site on an unsupported release cannot assume it is safe.

The seven CVSS 10 records

• AOS-10: CVE-2026-79844, authentication bypass leading to remote code execution; CVE-2026-79847 and CVE-2026-79851, unauthenticated buffer overflows leading to remote code execution.
• AOS-8: CVE-2026-79846, unauthenticated command injection; CVE-2026-79848 and CVE-2026-79849, unauthenticated SQL injection allowing remote code execution; CVE-2026-79850, authentication bypass leading to remote code execution.

BleepingComputer counts eight maximum-severity flaws among 72 in the bulletin, including an authentication bypass in the PAPI management protocol on AOS-10. It lists that one as CVE-2026-79845, but the public record under that number belongs to an unrelated product, so we leave it out until HPE's own text can be read. BleepingComputer quotes HPE as saying customers "are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities".

If upgrading has to wait

HPE's interim advice, as reported, is to confine the command-line and web management interfaces to a dedicated layer 2 segment or VLAN, or to control them with firewall policy at layer 3 and above. Several of the flaws are network-reachable without credentials, so a controller or gateway whose management interface can be reached from user or guest networks is the first to fix. The earlier October bulletin for AOS-Switch and ClearPass covers different products.

Related on TrustList:

• HPE fixes 46 Fabric Composer flaws, including built-in CLI passwords
• Juniper fixes nine critical Junos flaws, several giving root code execution
• Juniper fixes two critical root flaws in Session Smart Router

Sources

• Canadian Centre for Cyber Security: HPE security advisory (AV26-1079), 22 October 2026
• CVE-2026-79844: Authentication Bypass Leading to Remote Code Execution in AOS-10 (HPE CVE record), 22 October 2026
• CVE-2026-79846: Unauthenticated Command Injection Vulnerabilities in AOS-8 (HPE CVE record), 22 October 2026
• BleepingComputer: HPE patches eight max-severity RCE and auth bypass AOS flaws, 23 October 2026
• CVE Program: CVE-2026-79844, 22 October 2026