Hewlett Packard Enterprise has issued updates addressing 72 ArubaOS vulnerabilities, with eight described as maximum-severity authentication bypass and code execution flaws in BleepingComputer’s October 23, 2026 report. HPE urged customers to apply the patches promptly and limit access to management interfaces.
The eight flaws affect AOS-8 and AOS-10 and are rated as remotely exploitable with low complexity, without existing privileges or user interaction. For CVE-2026-79844 in AOS-10 and CVE-2026-79846 in AOS-8, however, HPE states that command execution requires certain preconditions outside the attacker's control; the bulletin does not specify those preconditions.
ArubaOS, also known as AOS, runs enterprise wireless infrastructure from Aruba Networking, including mobility conductors, access points, controllers and gateways.
Flaws span AOS-8 and AOS-10
For AOS-8, the report lists four maximum-severity issues. CVE-2026-79846 permits unauthenticated command injection, while CVE-2026-79848 and CVE-2026-79849 involve unauthenticated SQL injection leading to remote code execution. Authentication bypass leading to remote code execution is listed under CVE-2026-79850.
For AOS-10, authentication bypass leading to remote code execution is identified as CVE-2026-79844. Two further entries, CVE-2026-79847 and CVE-2026-79851, describe buffer overflows that allow unauthenticated remote code execution.
A genuine identifier conflict concerns CVE-2026-79845. HPE's October 22 bulletin assigns it to authentication bypass in AOS-10's PAPI protocol, with a CVSS v3.1 score of 10.0. The NVD record instead describes SQL injection in code-projects Simple Inventory System 1.0, with a CVSS v3.1 score of 7.3. Those product descriptions and scores must remain separate. For the ArubaOS issue, HPE's bulletin provides the affected releases and the remediation guidance.
Management access restrictions accompany patching advice
HPE’s mitigation guidance focuses on controlling access to the CLI and web management interfaces. As quoted by BleepingComputer, the company recommends a dedicated layer 2 segment/VLAN and/or firewall policies at layer 3 and above, together with accounting controls that track and log user activities and resource usage.
Affected versions and fixed releases
HPE recommends the following fixed versions or later in each corresponding release train:
| Release train | Affected through | Upgrade to |
|---|---|---|
| AOS-10.8.x.x | 10.8.1.1 | 10.8.1.2 |
| AOS-10.7.x.x | 10.7.2.6 | 10.7.2.7 |
| AOS-10.4.x.x | 10.4.1.13 | 10.4.1.14 |
| AOS-8.13.x.x | 8.13.3.0 | 8.13.3.1 |
| AOS-8.10.x.x | 8.10.0.23 | 8.10.0.24 |
HPE presumes that releases past end of maintenance are affected unless otherwise stated. It has not assessed exposure for releases past end of support and considers them potentially impacted; customers should move to a supported release.
BleepingComputer reported that HPE had found no evidence of exploitation in the wild or publicly available proof-of-concept exploit code. HPE’s quoted statement was bounded by the advisory’s release date: “HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory.”
