HPE fixes 72 vulnerabilities in Aruba AOS-8 and AOS-10

On 22 October 2026, HPE released security bulletin HPESBNW05162, which addresses 72 vulnerabilities in the Aruba Networking AOS-8 and AOS-10 wireless operating systems. HPE rates the bulletin critical. Eight of the flaws are rated CVSS 3.1 10.0. Among them, CVE-2026-79844 is an AOS-10 authentication bypass that HPE says can enable remote code execution. HPE notes that exploiting CVE-2026-79844 may require 'certain preconditions outside of the attacker's control'. HPE lists the patched releases as 10.8.1.2, 10.7.2.7, 10.4.1.14 for AOS-10 and 8.13.3.1, 8.10.0.24 for AOS-8, or later.

HPE says internal security research found many of the flaws, and the company is not aware of public discussion or exploit code as of the release date. HPE credits 20 CVEs to participants in its bug bounty program, four of them jointly with internal research, and one flaw to researchers from Siemens Energy. Rescana reported that as of 23 October 2026, none of the 72 CVEs was in CISA's Known Exploited Vulnerabilities catalog. GBHackers reported that CVE-2026-79855, an SSH authentication bypass in AOS-8, has a CVSS score of 9.8 and could let an unauthenticated attacker gain administrative privileges. The public CVE entry for CVE-2026-79845 points to a different product, so administrators should rely on HPE's bulletin for that flaw.

The affected products include Mobility Conductors, Mobility Controllers, Mobility Gateways, AOS-10 access points and AOS-8 Instant access points. HPE states that any appliance, virtual machine, or hardware device capable of running affected software is vulnerable. Affected releases include AOS-10 through 10.8.1.1, through 10.7.2.6, and through 10.4.1.13, plus AOS-8 through 8.13.3.0 and through 8.10.0.23. Of the 72 flaws, HPE's signed bulletin rates 33 critical, 31 high, 7 medium and 1 low. Of those critical flaws, 19 are reachable remotely, while the remaining 14 require an attacker on an adjacent network segment.

HPE urges customers to patch immediately because of the complexity, breadth and impact of the vulnerabilities. As a temporary measure, HPE recommends isolating the CLI and web-based management interfaces on a dedicated Layer 2 segment or VLAN, with firewall controls at Layer 3 and above, and logging of user activity and resource use. Rescana recommends keeping PAPI traffic, which uses UDP port 8211, off untrusted networks. Until patching, HPE recommends limiting access to management interfaces. The bulletin also states that end-of-maintenance releases are presumed affected and end-of-support releases are potentially impacted, so organizations should plan upgrades to supported branches. Patch every conductor, controller, gateway and access point to the fixed versions.