HPE patches critical unauthenticated flaws in Aruba AOS-8 and AOS-10
October 23 reports restate the October 22 HPE bulletin and Canadian alert without new exploitation or version facts.
HPE has patched critical unauthenticated Aruba AOS-8 and AOS-10 flaws and reports no public exploit code.
Hewlett Packard Enterprise’s October 22 bulletin HPESBNW05162 rev.1 patches authentication bypass, command injection, SQL injection, and buffer overflow flaws in Aruba Networking AOS-8 and AOS-10. Affected products include Mobility Conductors, controllers, gateways, and access points; several issues need no valid login. Cyber Security News reports eight CVEs scored CVSS 10.0, including CVE-2026-79850, which can run commands as root on AOS-8, and CVE-2026-79855, which can grant unauthenticated SSH administrative access. The Canadian Centre for Cyber Security’s alert AV26-1079 does not name CVEs and lists fixes starting at 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, and 8.10.0.24. HPE said it knew of no public exploit code and urged branch-specific upgrades, with management interfaces restricted until then.
- Fixes start at 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, and 8.10.0.24.
- Canadian alert AV26-1079, dated October 22, names no CVEs.
- CVE-2026-79845 can bypass AOS-10 PAPI login and change configuration.
- CVE-2026-79860 is triggered by crafted packets to AOS-8 UDP port 8211.
- Named CVEs also include CVE-2026-79847 and CVE-2026-79851.
- HPE recommends restricting management interfaces until upgrades are applied.
Timeline
dated events in the reporting · oldest first- Oct 22, 2026HPE published bulletin HPESBNW05162 rev.1 · Cyber Security News
- Oct 22, 2026Canadian Cyber Centre issued alert AV26-1079 · Canadian Centre for Cyber Security
What each outlet adds
beyond the shared facts- Canadian Centre for Cyber SecurityNames alert AV26-1079 and fixed builds, without CVEs or exploit status.
- Cyber Security NewsNames CVEs, CVSS 10.0 scores, and no known public exploit code.
Coverage
oldest first · one row per article · UTC- · 2d ago
Canadian Centre for Cyber SecurityFirst report
HPE Networking Wireless AOS has multiple flaws in older releases
Canadian Cyber Centre alert AV26-1079 points administrators to HPE bulletin HPESBNW05162 rev.1 for fixes.
- · 2d ago
Cyber Security News
HPE patches critical Aruba AOS flaws that can fully control devices
Eight CVEs score CVSS 10.0; unauthenticated AOS-8 flaws can run commands as root, and HPE knew of no public exploit code.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79845 | A vulnerability was identified in code-projects Simple Inventory System 1.0 | 5.5 | <1% | ||
CVE-2026-79847+1 related CVE | Unauthenticated buffer overflow RCE in HPE AOS-10 | 10.0 | — | ||
CVE-2026-79850+2 related CVEs | Unauthenticated root command execution in HPE Aruba AOS-8 | 10.0 group max | — |