The original text is in EN, taken from the source site. Source ↗

HPE patches eight max severity RCE and auth bypass AOS flaws

By Sergiu Gatlan

October 23, 2026

08:48 AM

0

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.

Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices.

The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction.

HPE warned customers to patch these security issues as soon as possible and provided mitigation measures, including restricting access to AOS management interfaces.

"Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," the company warned in a Thursday security advisory.

"To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage."

The full list of maximum severity flaws fixed today can be found in the table embedded below:

CVE-ID Vulnerability

CVE-2026-79844 Authentication Bypass Leading to RCE in AOS-10

CVE-2026-79845 Authentication Bypass in the PAPI Protocol of AOS-10

CVE-2026-79846 Unauthenticated Command Injection in AOS-8

CVE-2026-79847 Unauthenticated Buffer Overflow leads to RCE in AOS-10

CVE-2026-79848 Unauthenticated SQL Injection leading to RCE in AOS-8

CVE-2026-79849 Unauthenticated SQL Injection leading to RCE in AOS-8

CVE-2026-79850 Authentication Bypass leading to RCE in AOS-8

CVE-2026-79851 Unauthenticated Buffer Overflow leading to RCE in AOS-10

The company added that it has not yet found publicly available proof-of-concept exploit code or evidence that these vulnerabilities are being exploited in the wild.

"HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory," it said.

In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution and, one month later, warned of hardcoded credentials in Aruba Instant On Access Points that can let attackers bypass device authentication.

In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also flagged a maximum-severity HPE OneView vulnerability as exploited in attacks.

More recently, HPE warned of critical flaws allowing admin password resets and remote code execution on unpatched AOS-CX devices.

HPE employs more than 61,000 people worldwide and provides services and products to over 55,000 enterprise customers worldwide, including 90% of Fortune 500 companies.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Related Articles:

HPE patches critical ArubaOS-CX remote code execution flaw

GitLab warns of new max severity code execution vulnerability

PHP ships emergency patches for critical PHP2Shell flaws

F5 releases out-of-band patches for critical NGINX vulnerabilities

Hackers exploit SiteGuard WAF flaw to run commands as admins