Zaifliklar
HPE Tarmoq Mahsulotlaridagi O'nlab Jiddiy Kamchiliklarni Tuzatdi
Sakkizta maksimal darajadagi xavfsizlik nuqsonlari masofadan kod bajarish va autentifikatsiyani chetlab o'tishga olib kelishi mumkin.
Muallif
Ionut Arghire
| 2026-yil 27-oktabr (ET 9:13)
HPE o'tgan hafta Aruba tarmoq mahsulotlarining AOS-8 va AOS-10 simsiz operatsion tizimlaridagi 72 ta zaiflikni tuzatish uchun yangilanishlar chiqardi, jumladan 33 ta jiddiy darajadagi kamchilik.
Xavfsizlik yangilanishlari sakkizta maksimal darajadagi xatolikni bartaraf etadi: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850 va CVE-2026-79851.
Ushbu xavfsizlik nuqsonlarining muvaffaqiyatli ekspluatatsiyasi autentifikatsiyalanmagan hujumchilarga masofadan kod bajarish (RCE), autentifikatsiyani chetlab o'tib ma'muriy huquqlarga ega bo'lish, ixtiyoriy buyruqlarni bajarish va ta'sirlangan tizimlarni to'liq buzib kirish imkonini berishi mumkin.
HPE Networking'ning AOS versiyalari 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 va 10.8.1.2 barcha sakkizta xatolik uchun tuzatishlarni o'z ichiga oladi va harakatlanish o'tkazgichi, nazoratchi, shlyuz va kirish nuqtasi mahsulotlari bo'ylab tarqatilgan.
Yangilanishlar bilan hal qilingan qolgan jiddiy darajadagi muammolar autentifikatsiyalanmagan RCE, buyruq bajarish, ma'lumot oshkor qilish, autentifikatsiyani chetlab o'tish, fayl buzish, ma'muriy kirish va tizimni to'liq buzib kirishga olib kelishi mumkin, deb ta'kidlaydi HPE o'z maslahatida.
HPE shuningdek, o'z tarmoq mahsulotlari bo'ylab 31 ta yuqori darajadagi zaiflikni, jumladan autentifikatsiyasiz ekspluatatsiya qilinishi mumkin bo'lgan o'ndan ortiq zaiflikni, sakkizta o'rta darajadagi kamchilikni va bitta past darajadagi zaiflikni bartaraf etdi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Kompaniya ta'kidlaydiki, zaif simsiz operatsion tizimlar bilan mos keladigan barcha "apparat, harakatlanish yechimlari (masalan, o'tkazgichlar, nazoratchilar va shlyuzlar), kirish nuqtalari yoki virtual mashinalar (VM)" ham ushbu xavfsizlik muammolaridan ta'sirlangan.
"Hujumchining ushbu zaifliklardan foydalanish ehtimolini minimallashtirish uchun HPE Networking CLI va veb-interfeysga asoslangan boshqaruv interfeyslarini maxsus 2-qatlam segmenti/VLAN bilan cheklashni va/yoki 3-qatlam va undan yuqori qatlamlarda xavfsizlik devori siyosatlari bilan nazorat qilishni, shuningdek foydalanuvchi faoliyatlari va resurslardan foydalanishni kuzatish va qayd etish uchun hisob qaydnomalarini tavsiya qiladi," deb ta'kidlaydi HPE.
Kompaniya ushbu zaifliklardan birortasi yovvoyi tabiatda ekspluatatsiya qilinganidan xabardor emasligini aytadi, ammo mijozlarni yangilanishlarni iloji boricha tezroq qo'llashga chaqiradi.
Bog'liq:iOS, macOS 27.2 286 ta xatolikni tuzatdi; Ekspluatatsiya qilingan kamchilikni tuzatish iOS 18 ga qaytarildi
Bog'liq:Bu Normal: NetScaler Zero-Day'lari Yangi Normal haqida bizga nima aytadi
Bog'liq:Dengiz Koalitsiyasi Kema va Port Tizimlari uchun Bepul Zaiflik Ma'lumotlar Bazasini Ishga Tushirdi
Bog'liq:Node2Shell: Brotli Kamchiligi Microsoft, Node.js, Python Paketlari bo'ylab Yangilanishni Keltirib Chiqardi
YozganIonut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik Axborot Byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalari va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek Elektron Pochta Axborotiga obuna bo'ling.
Biznes Elektron Pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik Siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- Genesys Hack Ichki Tizimlardan Mijoz Ma'lumotlarini Oshkor Qildi
- 953 ta Onlayn Do'kon Uzoq Davom Etgan Zararli Dastur Kampaniyasida Yuqtirildi
- Golland Politsiyasi Bank Hisoblaridan 400 000 dollardan ortiq mablag'ni o'g'irlagan NFC Relay Hujumlari bo'yicha Ikki Shaxsni Hibsga Oldi
- Mythos 5 Iyul Hujumida Haqiqiy Dunyodagi Zararni E'tiborsiz Qoldirdi
- Xitoy APT ConnectWise Hujumlarida AI Pentest Vositasidan Foydalandi
- Hujumchilar To'rt Oy Ichida Uchinchi Arista VCO Zero-Day'ni Ekspluatatsiya Qildi
- Capcom Ma'lumotlar Buzilishidan 11 Million Kishi Ta'sirlandi
- LiteLLM Yangi Ta'minot Zanjiri Hujumida Buzildi
So'nggi Yangiliklar
- Tushuntirilmagan DreamHost Hodisasi Elektron Pochta, FTP Parollarini Qayta O'rnatishga Majbur Qildi
- iOS, macOS 27.2 286 ta Xatolikni Tuzatdi; Ekspluatatsiya Qilingan Kamchilikni Tuzatish iOS 18 ga Qaytarildi
- Anthropic Investorlar Uchun Spelled Out Xavflar O'z-o'zidan O'sib Boradigan AI dan Mumkin Zararlarni O'z Ichiga Oladi
- Bu Normal: NetScaler Zero-Days Yangi Normal haqida bizga nima aytadi
- O'lik Popcorn Time Yangilovchisi Millionlab Kompyuterlarni Buzib Kirish Xavfiga Qo'ydi
- Dengiz Koalitsiyasi Kema va Port Tizimlari uchun Bepul Zaiflik Ma'lumotlar Bazasini Ishga Tushirdi
- Kiberxavfsizlik Muammosi Yangi Meksika Katta Kasalxonasini Bemorlarni Boshqa Joyga Yo'naltirishga va Klinikalari Yopishga Majbur Qildi
- Anthropic Potensial Eng Katta IPO Uchun Ariza Topshirdi, Chunki Bosh Direktor AI dan Insoniyatga Xavf haqida Ogohlantirdi
Trend
Node2Shell: Brotli Kamchiligi Microsoft, Node.js, Python Paketlari bo'ylab Yangilanishni Keltirib Chiqardi
PHP2Shell Ekspluatatsiyasi Tekshiruvlardan Ishlaydigan Shell'largacha O'tdi
Mirai Botnet Operatorlari PHP2Shell Hujumlariga Qo'shildi, Chunki ASLR Bypass Ekspluatatsiyalari Paydo Bo'ldi
SecurityWeek Tahlili: 2024-yilning Birinchi Yarimida 178 ta Kiberxavfsizlik M&A Bitimlari E'lon Qilindi
953 ta Onlayn Do'kon Uzoq Davom Etgan Zararli Dastur Kampaniyasida Yuqtirildi
Xitoy APT ConnectWise Hujumlarida AI Pentest Vositasidan Foydalandi
Genesys Hack Ichki Tizimlardan Mijoz Ma'lumotlarini Oshkor Qildi
Sanoat Sotuvchilari PHP2Shell Zaifliklari Uchun Mahsulotlarini Tekshirmoqda
Kundalik Axborot Byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalar, shuningdek, soha mutaxassislari tomonidan chuqur fikrlar haqida xabardor bo'lish uchun SecurityWeek Elektron Pochta Axborotiga obuna bo'ling.
Biznes Elektron Pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik Siyosatimizni o'qing.
Vebinar: Sizning Google Workspace'dagi AI Kirish Xavfi Allaqachon Mavjud
2026-yil 19-oktabr
Google Workspace'ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingizning xavfini ochish va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual Tadbir: CISO Forumi 2026 Sammiti
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko'rib chiqish uchun birlashtirganimizda bizga qo'shiling.
Ro'yxatdan o'ting
Harakatdagi Odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS'da Kiber Integratsiya bo'yicha Yordamchi Direktor etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Ko'proq Harakatdagi Odamlar
Mutaxassis Fikrlari
Bu Normal: NetScaler Zero-Days Yangi Normal haqida bizga nima aytadi
Yana bir turdagi Citrix NetScaler yangilanishlari tez orada chiqarilishi mumkinligi uchun yangilanishlarni boshqarish quvurlarini tayyor saqlang. (Tod Beardsley)
AI Dasturiy Ta'minot Xavfsizligining Kaliti Tezlik Emas, Balki Yetuklikdir
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda joylashganligi siz xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi. (Matias Madou)
Kontekst Zamonaviy Kiberhujumlarga Qarshi Kurashda Qirol
Kontekstual mudofaa xavfsizlik jamoalariga signallarni ulash, keyin nima kelishini oldindan bilish va tahdidlar kuchayishidan oldin ularni to'xtatishga yordam beradi. (Etay Maor)
AI Hujum Tezligini O'zgartirdi, Xavfsizlik Asoslarini Emas
AI zaiflikni aniqlash va ekspluatatsiyani tezlashtirgan sari, virtual yangilanish deb ataladigan narsa hali ham chuqur mudofaa va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Kelajak Uchun Katta Rejalar Tuzgan To'rtta Kiber Tahdid
- AI, ta'minot zanjiri ta'siri, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishlarga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Vulnerabilities
HPE Patches Dozens of Critical Flaws in Networking Products
Eight max-severity security defects could lead to remote code execution and authentication bypass.
By
Ionut Arghire
| October 27, 2026 (9:13 AM ET)
*
HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws.
The security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.
Successful exploitation of these security defects could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authentication to gain administrative privileges, run arbitrary commands, and completely compromise the affected systems.
HPE Networking’s AOS versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2 contain fixes for all eight bugs and have been rolled out across mobility conductor, controller, gateway, and access point products.
The remaining critical-severity issues resolved with the updates could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access, and complete system compromise, HPE notes in its advisory.
HPE also resolved 31 high-severity vulnerabilities across its networking products, including over a dozen that could be exploited without authentication, eight medium-severity flaws, and one low-severity weakness.
Advertisement. Scroll to continue reading.
The company notes that all “hardware, mobility solutions (such as conductors, controllers, and gateways), access points, or virtual machines (VMs)” that are compatible with the vulnerable wireless operating systems are also affected by these security issues.
“To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage,” HPE notes.
The company says it is not aware of any of these vulnerabilities being exploited in the wild, but urges customers to apply the patches as soon as possible.
Related:iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Related:This Is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Related:Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related:Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Genesys Hack Exposes Customer Data From Internal Systems
- 953 Online Stores Infected in Long-Lasting Malware Campaign
- Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
- Mythos 5 Ignored Real-World Harm in July Attack
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
- 11 Million Impacted by Capcom Data Breach
- LiteLLM Compromised in Fresh Supply Chain Attack
Latest News
- Unexplained DreamHost Incident Prompts Email, FTP Password Resets
- iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
- Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
- This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
- Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
- Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
- Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
- Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
Trending
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
PHP2Shell Exploitation Moves From Probes to Working Shells
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024
953 Online Stores Infected in Long-Lasting Malware Campaign
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Genesys Hack Exposes Customer Data From Internal Systems
Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)