HPE AOS'dagi sakkizta maksimal darajadagi RCE va autentifikatsiyani chetlab o'tish zaifliklarini tuzatdi

HPE AOS'dagi sakkizta maksimal darajadagi RCE va autentifikatsiyani chetlab o'tish zaifliklarini tuzatdi

Muallif: Sergiu Gatlan

2026-yil 23-oktabr

08:48

0

Hewlett Packard Enterprise (HPE) Aruba Operating System (ArubaOS) tizimidagi 72 ta zaiflikni tuzatish uchun xavfsizlik yangilanishlarini e'lon qildi, jumladan sakkizta maksimal darajadagi autentifikatsiyani chetlab o'tish va kodni bajarish muammolari.

AOS nomi bilan ham tanilgan ArubaOS Aruba Networking korporativ simsiz infratuzilmasini, jumladan harakatlanish kontrollerlari, kirish nuqtalari, kontrollerlar va shlyuz qurilmalarini quvvatlaydi.

Bugun tuzatilgan sakkizta maksimal darajadagi xavfsizlik zaifliklari AOS-8 va AOS-10 dasturiy ta'minotining bir nechta versiyalariga ta'sir qiladi va ular masofadagi tahdid qiluvchilar tomonidan huquqlarsiz, past murakkablikdagi hujumlar orqali, foydalanuvchi o'zaro ta'sirini talab qilmasdan foydalanilishi mumkin.

HPE mijozlarga ushbu xavfsizlik muammolarini iloji boricha tezroq tuzatishni tavsiya qildi va AOS boshqaruv interfeyslariga kirishni cheklashni o'z ichiga olgan yumshatish choralarini taqdim etdi.

"Mijozlar ushbu zaifliklarning murakkabligi, kengligi va ta'siri tufayli o'z nusxalarini tuzatishga qat'iy chaqiriladi", — deb ogohlantirdi kompaniya payshanba kuni e'lon qilingan xavfsizlik maslahatida.

"Hujumchi ushbu zaifliklardan foydalanish ehtimolini minimallashtirish uchun HPE Networking CLI va veb-asosidagi boshqaruv interfeyslarini maxsus 2-qavat segmenti/VLAN bilan cheklashni va/yoki 3-qavat va undan yuqori qatlamlarda xavfsizlik devori siyosatlari bilan nazorat qilishni, shuningdek foydalanuvchi faoliyatlari va resurslardan foydalanishni kuzatish va qayd etish uchun hisobga olish nazoratlarini tavsiya qiladi."

Bugun tuzatilgan maksimal darajadagi zaifliklarning to'liq ro'yxatini quyidagi jadvalda topish mumkin:

CVE-ID | Zaiflik CVE-2026-79844 | AOS-10 da autentifikatsiyani chetlab o'tish orqali RCE CVE-2026-79845 | AOS-10 PAPI protokolida autentifikatsiyani chetlab o'tish CVE-2026-79846 | AOS-8 da autentifikatsiyasiz buyruq in'ektsiyasi CVE-2026-79847 | AOS-10 da autentifikatsiyasiz bufer to'lib ketishi RCE ga olib keladi CVE-2026-79848 | AOS-8 da autentifikatsiyasiz SQL in'ektsiyasi RCE ga olib keladi CVE-2026-79849 | AOS-8 da autentifikatsiyasiz SQL in'ektsiyasi RCE ga olib keladi CVE-2026-79850 | AOS-8 da autentifikatsiyani chetlab o'tish RCE ga olib keladi CVE-2026-79851 | AOS-10 da autentifikatsiyasiz bufer to'lib ketishi RCE ga olib keladi

Kompaniya ushbu zaifliklar uchun ommaviy foydalanish mumkin bo'lgan ekspluatatsiya kodi yoki ularning yovvoyi tabiatda foydalanilayotganiga dalil topilmaganini qo'shib qo'ydi.

"HPE Networking ushbu maslahat e'lon qilingan sanada ro'yxatga olingan zaifliklarga qaratilgan hech qanday ommaviy muhokama yoki ekspluatatsiya kodi haqida xabardor emas", — deb aytildi.

2025-yil iyun oyida HPE autentifikatsiyani chetlab o'tish va masofadan kodni bajarishga imkon beradigan sakkizta muhim StoreOnce zaifliklarini tuzatdi va bir oy o'tib Aruba Instant On Access Points qurilmalarida qattiq kodlangan ma'lumotlar haqida ogohlantirdi, bu hujumchilarga qurilma autentifikatsiyasini chetlab o'tishga imkon beradi.

2025-yil yanvar oyida AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) ham maksimal darajadagi HPE OneView zaifligini hujumlarda foydalanilayotgan deb belgiladi.

Yaqinda HPE tuzatilmagan AOS-CX qurilmalarida administrator parolini qayta o'rnatish va masofadan kodni bajarishga imkon beradigan muhim zaifliklar haqida ogohlantirdi.

HPE butun dunyo bo'ylab 61 000 dan ortiq xodimni ish bilan ta'minlaydi va butun dunyo bo'ylab 55 000 dan ortiq korporativ mijozlarga, jumladan Fortune 500 kompaniyalarining 90 foiziga xizmatlar va mahsulotlar taqdim etadi.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.

Blue Report 2026 mijozlarning ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikaga qarab mudofaani o'lchaydi.

Hisobotni oling

Tegishli maqolalar:

HPE muhim ArubaOS-CX masofadan kodni bajarish zaifligini tuzatdi

GitLab yangi maksimal darajadagi kodni bajarish zaifligi haqida ogohlantirdi

PHP muhim PHP2Shell zaifliklari uchun shoshilinch tuzatishlarni e'lon qildi

F5 muhim NGINX zaifliklari uchun rejalashtirilmagan tuzatishlarni e'lon qildi

Xakerlar SiteGuard WAF zaifligidan administrator sifatida buyruqlarni bajarish uchun foydalanmoqda

HPE patches eight max severity RCE and auth bypass AOS flaws

By Sergiu Gatlan

October 23, 2026

08:48 AM

0

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.

Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices.

The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction.

HPE warned customers to patch these security issues as soon as possible and provided mitigation measures, including restricting access to AOS management interfaces.

"Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," the company warned in a Thursday security advisory.

"To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage."

The full list of maximum severity flaws fixed today can be found in the table embedded below:

CVE-ID Vulnerability

CVE-2026-79844 Authentication Bypass Leading to RCE in AOS-10

CVE-2026-79845 Authentication Bypass in the PAPI Protocol of AOS-10

CVE-2026-79846 Unauthenticated Command Injection in AOS-8

CVE-2026-79847 Unauthenticated Buffer Overflow leads to RCE in AOS-10

CVE-2026-79848 Unauthenticated SQL Injection leading to RCE in AOS-8

CVE-2026-79849 Unauthenticated SQL Injection leading to RCE in AOS-8

CVE-2026-79850 Authentication Bypass leading to RCE in AOS-8

CVE-2026-79851 Unauthenticated Buffer Overflow leading to RCE in AOS-10

The company added that it has not yet found publicly available proof-of-concept exploit code or evidence that these vulnerabilities are being exploited in the wild.

"HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory," it said.

In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution and, one month later, warned of hardcoded credentials in Aruba Instant On Access Points that can let attackers bypass device authentication.

In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also flagged a maximum-severity HPE OneView vulnerability as exploited in attacks.

More recently, HPE warned of critical flaws allowing admin password resets and remote code execution on unpatched AOS-CX devices.

HPE employs more than 61,000 people worldwide and provides services and products to over 55,000 enterprise customers worldwide, including 90% of Fortune 500 companies.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Related Articles:

HPE patches critical ArubaOS-CX remote code execution flaw

GitLab warns of new max severity code execution vulnerability

PHP ships emergency patches for critical PHP2Shell flaws

F5 releases out-of-band patches for critical NGINX vulnerabilities

Hackers exploit SiteGuard WAF flaw to run commands as admins