HPE patches eight maximum-severity RCE and auth-bypass flaws in ArubaOS
Original title: HPE patches eight max severity RCE and auth bypass AOS flaws
The eight flaws hit AOS-8 and AOS-10 and can be exploited remotely without privileges or user interaction.
Hewlett Packard Enterprise released updates for 72 vulnerabilities in ArubaOS, which runs Aruba Networking mobility conductors, access points, controllers and gateways. Eight are maximum severity and include authentication bypass and unauthenticated command injection, buffer overflow and SQL injection leading to remote code execution. HPE said it is not aware of public exploit code or exploitation. It urged customers to patch and to restrict CLI and web management interfaces.
Unconfirmed: Fixed version numbers are not stated, and HPE says it has not seen exploitation or public exploit code.
- The eight flaws are CVE-2026-79844 through CVE-2026-79851.
- Issues span AOS-8 and AOS-10; exact version ranges are not listed.
- HPE recommends a dedicated layer-2 segment or VLAN plus layer-3 firewall controls.
- HPE said it had found no public discussion or exploit code as of the advisory.
Impact: unauthenticated remote code execution or authentication bypass
| Product | Affected |
|---|---|
| HPE ArubaOS (AOS-8 and AOS-10) | multiple AOS-8 and AOS-10 software versions |
- 1.Apply the ArubaOS security updates as soon as possible.
- 2.Restrict CLI and web management interfaces to a dedicated VLAN or firewall policy.
- CVEs
- CVE-2026-79844CVE-2026-79845CVE-2026-79846CVE-2026-79847CVE-2026-79848CVE-2026-79849CVE-2026-79850CVE-2026-79851
- Vendors
- Hewlett Packard Enterprise
- Products
- ArubaOS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-79844+2 related CVEs | Authentication bypass in HPE AOS-10 under external preconditions | 10.0 | — | ||
| CVE-2026-79845 | A vulnerability was identified in code-projects Simple Inventory System 1.0 | 5.5 | <1% | ||
CVE-2026-79846+3 related CVEs | Unauthenticated command injection in HPE Aruba AOS-8 | 10.0 | — |
From the original article
2 min read at bleepingcomputer.com
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.