HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 wireless

22 October 2026: Hewlett Packard Enterprise has fixed a group of maximum-severity flaws in AOS-10 and AOS-8, the operating systems of its Aruba wireless access points, gateways and controllers, in security bulletin HPESBNW05162. Seven CVE records published by HPE on 22 October each score 10.0 and describe attacks that need no login: authentication bypass, command injection, SQL injection and buffer overflows, all leading to remote code execution. HPE has said it knows of no public exploit code, according to BleepingComputer.

Not yet independently verified. HPE's bulletin page renders only in a browser, so the fixed versions here come from the Canadian Cyber Centre and the CVE records; the total of 72 flaws, the eighth maximum-severity flaw and HPE's wording on exploitation come from BleepingComputer. We will update this when it can be confirmed, and remove this note.

Fixed releases

The Canadian Centre for Cyber Security lists every version before these as affected:

Line	Fixed release
AOS-10.8	10.8.1.2
AOS-10.6 and 10.7	10.7.2.7
AOS-10.3 and 10.4	10.4.1.14
AOS-8.12 and 8.13	8.13.3.1
AOS-8.10	8.10.0.24

The CVE records give the affected ranges as AOS-10 10.3.0.0 to 10.4.1.13, 10.6.0.0 to 10.7.2.6 and 10.8.0.0 to 10.8.1.1, and AOS-8 8.10.0.0 to 8.10.0.23 and 8.12.0.0 to 8.13.3.0. Older branches outside those ranges are not named, so a site on an unsupported release cannot assume it is safe.

The seven CVSS 10 records

• AOS-10: CVE-2026-79844, authentication bypass leading to remote code execution; CVE-2026-79847 and CVE-2026-79851, unauthenticated buffer overflows leading to remote code execution.
• AOS-8: CVE-2026-79846, unauthenticated command injection; CVE-2026-79848 and CVE-2026-79849, unauthenticated SQL injection allowing remote code execution; CVE-2026-79850, authentication bypass leading to remote code execution.

BleepingComputer counts eight maximum-severity flaws among 72 in the bulletin, including an authentication bypass in the PAPI management protocol on AOS-10. It lists that one as CVE-2026-79845, but the public record under that number belongs to an unrelated product, so we leave it out until HPE's own text can be read. BleepingComputer quotes HPE as saying customers "are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities".

If upgrading has to wait

HPE's interim advice, as reported, is to confine the command-line and web management interfaces to a dedicated layer 2 segment or VLAN, or to control them with firewall policy at layer 3 and above. Several of the flaws are network-reachable without credentials, so a controller or gateway whose management interface can be reached from user or guest networks is the first to fix. The earlier October bulletin for AOS-Switch and ClearPass covers different products.

Sources

• Canadian Centre for Cyber Security: HPE security advisory (AV26-1079), 22 October 2026
• CVE-2026-79844: Authentication Bypass Leading to Remote Code Execution in AOS-10 (HPE CVE record), 22 October 2026
• CVE-2026-79846: Unauthenticated Command Injection Vulnerabilities in AOS-8 (HPE CVE record), 22 October 2026
• BleepingComputer: HPE patches eight max-severity RCE and auth bypass AOS flaws, 23 October 2026