HPE patches 72 Aruba networking flaws, 33 critical

HPE last week issued patches for 72 flaws in AOS-8 and AOS-10, the wireless operating systems used by Aruba networking gear; 33 of them are critical, SecurityWeek reported. Eight of the critical bugs are rated maximum severity, identified as CVE-2026-79844 through CVE-2026-79851. The vendor said exploitation of these flaws could let unauthenticated attackers run code remotely, authenticate as an administrator, execute arbitrary commands and fully compromise affected systems.

HPE's advisory lists fixed AOS releases 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2 for mobility conductors, controllers, gateways and access points. The advisory says the other critical issues fixed by the update could let an unauthenticated attacker run code remotely, execute commands, read sensitive information, bypass login, modify files, gain admin access and fully compromise devices.

The patch batch also resolves 31 high-severity vulnerabilities, more than a dozen of which are exploitable without authentication, plus eight medium-severity and one low-severity flaw. HPE said all hardware, mobility components such as conductors, controllers and gateways, access points, and virtual machines that use the vulnerable operating systems are affected.

The vendor said it has no evidence that any of the vulnerabilities are being exploited in the wild, but it recommended immediate patching. To reduce risk, HPE advises restricting CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, controlling them with layer 3 and higher firewall policies, and using accounting controls to track and log user actions and resource usage.

Defenders should compare their Aruba AOS version with the fixed releases, apply the updates, then restrict management access as HPE describes and monitor logs on conductors, controllers, gateways and access points for unusual activity.