HPE, Cisco and Apache ship patches for critical flaws
ArubaOS, Cisco, and Tomcat updates fix remote code execution, authentication bypass, and data exposure. None of the vendors report active exploitation.
HPE published fixes for 72 ArubaOS vulnerabilities, including eight maximum-severity flaws in AOS-8 and AOS-10. The eight CVEs, CVE-2026-79844 through CVE-2026-79851, cover authentication bypass, command injection, buffer overflow, and SQL injection that can lead to remote code execution. They are exploitable by a remote attacker without credentials, and the attacks need no user action. HPE urged customers to patch quickly and to confine the CLI and web-based management interfaces to a dedicated VLAN or layer 2 segment with layer 3 firewall controls. The company said it had not seen public exploit code or signs of active abuse when the advisory was published.
Cisco shipped fixes for 34 vulnerabilities in its Expressway, IOS XR, Snort 3, and Unified Communications lines. CVE-2026-76466 is a critical Expressway remote code execution bug that can let an attacker execute arbitrary commands as root after connecting to the database service and invoking specific RPC calls. The patch appears in Expressway X15.5.20. Unified Communications fixes include CVE-2026-76473, plus CVE-2026-76474 and CVE-2026-76475, which aggregate improper authentication, resource control, and input neutralization flaws. Snort 3 received fixes for two critical defects, CVE-2026-20236 and CVE-2026-20043, included in version 3.12.4.0. Cisco also patched a high-severity privilege escalation in Secure Client's firewall posture component, CVE-2026-76462, and a high-severity denial-of-service bug in IOS XR, CVE-2026-76505. The vendor said it has no evidence that any of these vulnerabilities are being exploited.
Apache fixed eight Tomcat vulnerabilities in versions 11.0.27, 10.1.61, and 9.0.123. Three of them carry an Important rating. CVE-2026-101296 permits authentication bypass in JNDIRealm when configured with a non-GSSAPI SASL mechanism, so an attacker can log in without the correct password. CVE-2026-101356 can mix HTTP/2 requests and responses between users after an error in asynchronous servlet processing. CVE-2026-103119 can split an AJP response body so the next request on the same connection receives part of the prior response. The affected ranges are 11.0.0-M1 to 11.0.26, 10.1.0-M1 to 10.1.60, and 9.0.0.M1 to 9.0.122 for the JNDIRealm flaw, and 11.0.22 to 11.0.26, 10.1.55 to 10.1.60, and 9.0.118 to 9.0.122 for the HTTP/2 mix-up. The remaining five flaws are Low severity and include HTTP/2 trailer leakage, intermittent TLS 1.3 failures, a Jasper redirect issue, FIPS activation failure, and a local APR socket race. Apache's advisories do not report active exploitation. Administrators should move to the fixed release for their Tomcat branch.
Sources
- HPE patches eight max severity RCE and auth bypass AOS flaws, BleepingComputer
- Cisco Patches 34 Vulnerabilities Across Multiple Products, SecurityWeek
- Apache Tomcat Fixes 8 Security Flaws That Could Let Hackers Bypass Authentication, CyberSecurityNews
Lena Vasquez covers vulnerabilities, breaches and identity for Five Nines. She writes from advisories, vendor bulletins and published reporting.
Corrections. Report an error to corrections@thefivenines.com. We list substantive corrections on the corrections page.