HPE patches critical Aruba AOS flaws that can fully control devices
Original title: HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices
Eight CVEs score CVSS 10.0; unauthenticated AOS-8 flaws can run commands as root, and HPE knew of no public exploit code.
Hewlett Packard Enterprise’s October 22 bulletin HPESBNW05162 patches authentication bypass, command injection, SQL injection, and buffer overflow flaws in Aruba Networking AOS-8 and AOS-10. Affected deployments include Mobility Conductors, Controllers, Gateways, and access points. Several issues need no valid login. HPE recommends branch-specific upgrades and, until then, restricting management interfaces. It reported no public discussion or exploit code at release.
Unconfirmed: HPE knew of no public discussion or exploit code; whether attacks have occurred is not established.
- CVE-2026-79850 bypasses AOS-8 authentication and runs commands as root.
- CVE-2026-79855 can grant unauthenticated administrative access via the AOS-8 SSH service.
- CVE-2026-79845 affects AOS-10 PAPI and can bypass login checks and change configuration.
- CVE-2026-79860 is triggered by crafted packets to UDP port 8211 on AOS-8.
- Fixed builds include AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, and AOS-8.10.0.24.
Impact: Full device control, sensitive data access, or privileged command execution
| Product | Affected | Fixed in |
|---|---|---|
| HPE Aruba Networking AOS-10 | AOS-10.8.1.1, AOS-10.7.2.6, and AOS-10.4.1.13 and earlier in those branches | AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, and later releases in those branches |
| HPE Aruba Networking AOS-8 | AOS-8.13.3.0 and AOS-8.10.0.23 and earlier in those branches | AOS-8.13.3.1, AOS-8.10.0.24, and later releases in those branches |
- 1.Upgrade to the fixed release for the installed AOS branch via the HPE Networking Support Portal.
- 2.Until patched, restrict CLI and web management to a dedicated segment or VLAN with firewall rules.
- 3.Enable controls that track and log user activity; they do not replace the patches.
- Vendors
- Hewlett Packard Enterprise
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79845 | A vulnerability was identified in code-projects Simple Inventory System 1.0 | 5.5 | <1% | ||
CVE-2026-79847+1 related CVE | Unauthenticated buffer overflow RCE in HPE AOS-10 | 10.0 | — | ||
CVE-2026-79850+2 related CVEs | Unauthenticated root command execution in HPE Aruba AOS-8 | 10.0 group max | — |
From the original article
2 min read at cybersecuritynews.com
Hewlett Packard Enterprise has released security patches for multiple vulnerabilities in Aruba Networking wireless software that could let attackers take complete control of affected devices. The flaws affect AOS-8 and AOS-10 deployments across Mobility Conductors, Controllers, Gateways, and access points. Several allow attacks without a valid login, making prompt patching a priority for network administrators.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.