HPE patches 72 Aruba AOS flaws, eight at maximum severity
Original title: HPE Patches Dozens of Critical Flaws in Networking Products
Unauthenticated attackers could gain remote code execution or admin access; HPE reports no known exploitation.
HPE released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of Aruba networking products, including 33 critical-severity flaws. Eight maximum-severity bugs can let unauthenticated attackers achieve remote code execution, bypass authentication for administrative privileges, run arbitrary commands or fully compromise systems. Fixes are in AOS 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2. HPE also fixed 31 high-severity, eight medium-severity and one low-severity issues, and says it knows of no in-the-wild exploitation.
- The eight maximum-severity bugs are CVE-2026-79844 through CVE-2026-79851.
- More than a dozen high-severity flaws need no authentication.
- Compatible conductors, controllers, gateways, access points and VMs are affected.
- HPE advises restricting CLI and web management to a dedicated VLAN or firewall.
Impact: Unauthenticated remote code execution and full system compromise
| Product | Affected | Fixed in |
|---|---|---|
| HPE AOS-8 | — | 8.10.0.24, 8.13.3.1 |
| HPE AOS-10 | — | 10.4.1.14, 10.7.2.7, 10.8.1.2 |
- 1.Install the listed AOS-8 and AOS-10 fixed versions as soon as possible.
- 2.Restrict CLI and web management interfaces to a dedicated VLAN or firewall.
- CVEs
- CVE-2026-79844CVE-2026-79845CVE-2026-79846CVE-2026-79847CVE-2026-79848CVE-2026-79849CVE-2026-79850CVE-2026-79851
- Vendors
- HPE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-79844+2 related CVEs | Authentication bypass in HPE AOS-10 under external preconditions | 10.0 | — | ||
| CVE-2026-79845 | A vulnerability was identified in code-projects Simple Inventory System 1.0 | 5.5 | <1% | ||
CVE-2026-79846+3 related CVEs | Unauthenticated command injection in HPE Aruba AOS-8 | 10.0 | — |
From the original article
1 min read at securityweek.com
Eight max-severity security defects could lead to remote code execution and authentication bypass. The post HPE Patches Dozens of Critical Flaws in Networking Products appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.