# HPE ArubaOS (AOS-8 / AOS-10): eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws · pwn.watch > HPE Networking patched 72 vulnerabilities in its wireless operating systems AOS-8 and AOS-10 (ArubaOS) on Oct 22 2026 (advisory HPESBNW05162). Eight are rated CVSS 10.0: authentication bypasses, command injection, SQL injection and buffer overflows that let an unauthenticated remote attacker run code on Mobility Conductors, Controllers, Gateways and Access Points, several through the web management interface and the PAPI protocol. HPE urges customers to patch quickly and to restrict management interfaces. It knows of no public exploit code or exploitation. Page: https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026 · generated 2026-10-23T15:31:19.215Z ## Status - Severity: critical · status: live · patch: patched - Product: HPE Networking (Aruba) wireless OS AOS-8 and AOS-10: Mobility Conductors, Controllers, Gateways, Access Points - Started: 2026-10-22 - CVEs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851 - Affected: AOS-10.8.x.x: 10.8.1.1 and below; AOS-10.7.x.x: 10.7.2.6 and below; AOS-10.4.x.x: 10.4.1.13 and below; AOS-8.13.x.x: 8.13.3.0 and below; AOS-8.10.x.x: 8.10.0.23 and below; End-of-Maintenance releases are presumed affected and get no fix - Fixed in: AOS-10.8.1.2; AOS-10.7.2.7; AOS-10.4.1.14; AOS-8.13.3.1; AOS-8.10.0.24 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026.json - This file: https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026/llms.txt ## Updates (newest first) - 2026-10-23: BleepingComputer reports the eight maximum-severity flaws and HPE's advice to restrict CLI and web management interfaces to a dedicated VLAN or firewall them. (https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/) - 2026-10-22: HPE publishes HPESBNW05162 with fixes for 72 AOS-8 and AOS-10 vulnerabilities, eight of them CVSS 10.0, mostly found by its own security research. It knows of no public exploit code. (https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt) - 2026-10-15: HPE Networking publishes an advance notification of the security advisories due on Oct 22. (https://networkingsupport.hpe.com/notifications) ## Fix brief # Security brief: HPE ArubaOS (AOS-8 / AOS-10): eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws Source: https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026 · status: live · severity: critical · updated Oct 23, 2026, 15:30 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is HPE Networking patched 72 vulnerabilities in its wireless operating systems AOS-8 and AOS-10 (ArubaOS) on Oct 22 2026 (advisory HPESBNW05162). Eight are rated CVSS 10.0: authentication bypasses, command injection, SQL injection and buffer overflows that let an unauthenticated remote attacker run code on Mobility Conductors, Controllers, Gateways and Access Points, several through the web management interface and the PAPI protocol. HPE urges customers to patch quickly and to restrict management interfaces. It knows of no public exploit code or exploitation. Severity detail: Eight CVEs at CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) plus many more rated Critical in the same 72-CVE advisory; HPE knows of no public exploit or in-the-wild exploitation - Product: HPE Networking (Aruba) wireless OS AOS-8 and AOS-10: Mobility Conductors, Controllers, Gateways, Access Points - CVE / advisory ids: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851 ## Affected versions - AOS-10.8.x.x: 10.8.1.1 and below - AOS-10.7.x.x: 10.7.2.6 and below - AOS-10.4.x.x: 10.4.1.13 and below - AOS-8.13.x.x: 8.13.3.0 and below - AOS-8.10.x.x: 8.10.0.23 and below - End-of-Maintenance releases are presumed affected and get no fix ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - AOS-10.8.1.2 - AOS-10.7.2.7 - AOS-10.4.1.14 - AOS-8.13.3.1 - AOS-8.10.0.24 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Check the AOS version on each Mobility Conductor, Controller, Gateway and AP (`show version`). Upgrade to AOS-10.8.1.2, 10.7.2.7 or 10.4.1.14, or AOS-8.13.3.1 or 8.10.0.24 from the HPE Networking Support Portal. Until patched, restrict the CLI and web management interfaces to a dedicated layer 2 segment or VLAN and/or firewall them. Releases past End of Maintenance get no fix and should be upgraded to a supported train. ## Latest updates - Oct 23, 2026: BleepingComputer reports the eight maximum-severity flaws and HPE's advice to restrict CLI and web management interfaces to a dedicated VLAN or firewall them. - Oct 22, 2026: HPE publishes HPESBNW05162 with fixes for 72 AOS-8 and AOS-10 vulnerabilities, eight of them CVSS 10.0, mostly found by its own security research. It knows of no public exploit code. - Oct 15, 2026: HPE Networking publishes an advance notification of the security advisories due on Oct 22. ## Advisories - [HPESBNW05162: Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-8 and AOS-10)](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US) (HPE) - [HPESBNW05162 (CSAF text version)](https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt) (HPE) - [CVE-2026-79844](https://www.cve.org/CVERecord?id=CVE-2026-79844) (CVE.org) ## Write-ups & news - [HPE patches eight max severity RCE and auth bypass AOS flaws](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/) ## Caveats Primary source is HPE's HPESBNW05162 rev.1 (Oct 22 2026). The advisory covers 72 CVEs; only the eight CVSS 10.0 ones are listed in cveIds. A separate HPE advisory the same day (HPESBNW05171) covers PHP2Shell in ClearPass Policy Manager and is not part of this incident. --- Machine-readable: https://pwn.watch/i/hpe-aruba-aos-critical-rce-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.