Hewlett Packard Enterprise (HPE) has released a security update addressing 72 vulnerabilities in Aruba Operating System (ArubaOS), including eight maximum-severity flaws that can enable authentication bypass and remote code execution. The issues affect multiple ArubaOS 8 and ArubaOS 10 versions and can be exploited remotely without user interaction.
ArubaOS, also known as AOS, powers Aruba Networking enterprise wireless infrastructure, including Mobility Conductors, access points, controllers and gateway devices.
Eight maximum-severity ArubaOS flaws
According to HPE, the eight highest-severity vulnerabilities can be exploited by unauthorized remote attackers using low-complexity attacks. The company urged customers to install the available updates as soon as possible and recommended restricting access to ArubaOS management interfaces as an additional mitigation.
“Given the complexity, scope, and impact of these vulnerabilities, we strongly encourage customers to patch their instances,” HPE warned in its Thursday security advisory.
“To minimize the potential for an attacker to exploit these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated Layer 2 segment/VLAN or controlled by a Layer 3 or higher firewall policy with accounting controls to track and record user activity and resource usage.”
The eight maximum-severity flaws are:
| CVE-ID | Vulnerability |
| CVE-2026-79844 | Authentication bypass leading to RCE on AOS-10 |
| CVE-2026-79845 | Authentication bypass in AOS-10’s PAPI protocol |
| CVE-2026-79846 | Unauthenticated command injection in AOS-8 |
| CVE-2026-79847 | Unauthenticated buffer overflow causing RCE in AOS-10 |
| CVE-2026-79848 | Unauthenticated SQL injection causing RCE on AOS-8 |
| CVE-2026-79849 | Unauthenticated SQL injection causing RCE on AOS-8 |
| CVE-2026-79850 | Authentication bypass leading to RCE in AOS-8 |
| CVE-2026-79851 | Unauthenticated buffer overflow causing RCE on AOS-10 |
No known exploitation reported
HPE said it has not identified publicly available proof-of-concept exploit code or evidence that the vulnerabilities are being exploited in the wild.
“HPE Networking is not aware of any public discussion or exploitation code targeting the listed vulnerabilities as of the date of this advisory’s release,” the company said.
The update follows several recent HPE security disclosures. In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution. A month later, the company warned that hard-coded credentials in Aruba Instant On access points could allow attackers to bypass device authentication.
In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that a maximum-severity HPE OneView vulnerability had been exploited in an attack. Most recently, HPE warned of a critical vulnerability that could allow an administrator password reset and remote code execution on unpatched AOS-CX devices.
HPE has more than 61,000 employees worldwide and provides services and products to more than 55,000 business customers, including 90% of Fortune 500 companies.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com