HPE ArubaOS (AOS-8 / AOS-10): eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws
HPE Networking (Aruba) wireless OS AOS-8 and AOS-10: Mobility Conductors, Controllers, Gateways, Access Points
HPE Networking patched 72 vulnerabilities in its wireless operating systems AOS-8 and AOS-10 (ArubaOS) on Oct 22 2026 (advisory HPESBNW05162). Eight are rated CVSS 10.0: authentication bypasses, command injection, SQL injection and buffer overflows that let an unauthenticated remote attacker run code on Mobility Conductors, Controllers, Gateways and Access Points, several through the web management interface and the PAPI protocol. HPE urges customers to patch quickly and to restrict management interfaces. It knows of no public exploit code or exploitation.
Why this severity: Eight CVEs at CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) plus many more rated Critical in the same 72-CVE advisory; HPE knows of no public exploit or in-the-wild exploitation
- Started
- Oct 22, 2026
Affected
- AOS-10.8.x.x: 10.8.1.1 and below
- AOS-10.7.x.x: 10.7.2.6 and below
- AOS-10.4.x.x: 10.4.1.13 and below
- AOS-8.13.x.x: 8.13.3.0 and below
- AOS-8.10.x.x: 8.10.0.23 and below
- End-of-Maintenance releases are presumed affected and get no fix
Fixed in
- AOS-10.8.1.2
- AOS-10.7.2.7
- AOS-10.4.1.14
- AOS-8.13.3.1
- AOS-8.10.0.24
Timeline3
BleepingComputer reports the eight maximum-severity flaws and HPE's advice to restrict CLI and web management interfaces to a dedicated VLAN or firewall them.
HPE publishes HPESBNW05162 with fixes for 72 AOS-8 and AOS-10 vulnerabilities, eight of them CVSS 10.0, mostly found by its own security research. It knows of no public exploit code.
HPE Networking publishes an advance notification of the security advisories due on Oct 22.
Advisories3
News & write-ups1
Posts2
HPE fixes 72 HPE Networking AOS vulnerabilities, including PAPI protocol flaws and CVSS 10 bugs CVE-2026-79844, CVE-2026-79845 and CVE-2026-79846. #HPE #Aruba #AOS10 #CVE202679844 #CVE202679845 #CVE202679846 #WiFiSecurity #CyberSecurity t.co/AmFXQm5g8G
HPE patched 72 ArubaOS vulnerabilities, including eight maximum-severity flaws affecting AOS-8 and AOS-10 that could allow unauthenticated remote code execution. HPE reported no known public exploit code or in-the-wild exploitation. t.co/KNdKKLKOzK
Notes & caveats
Primary source is HPE's HPESBNW05162 rev.1 (Oct 22 2026). The advisory covers 72 CVEs; only the eight CVSS 10.0 ones are listed in cveIds. A separate HPE advisory the same day (HPESBNW05171) covers PHP2Shell in ClearPass Policy Manager and is not part of this incident.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
