Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Vulnerabilities

HPE Patches Dozens of Critical Flaws in Networking Products

Eight max-severity security defects could lead to remote code execution and authentication bypass.

By

Ionut Arghire

| October 27, 2026 (9:13 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws.

The security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.

Successful exploitation of these security defects could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authentication to gain administrative privileges, run arbitrary commands, and completely compromise the affected systems.

HPE Networking’s AOS versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2 contain fixes for all eight bugs and have been rolled out across mobility conductor, controller, gateway, and access point products.

The remaining critical-severity issues resolved with the updates could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access, and complete system compromise, HPE notes in its advisory.

HPE also resolved 31 high-severity vulnerabilities across its networking products, including over a dozen that could be exploited without authentication, eight medium-severity flaws, and one low-severity weakness.

Advertisement. Scroll to continue reading.

The company notes that all “hardware, mobility solutions (such as conductors, controllers, and gateways), access points, or virtual machines (VMs)” that are compatible with the vulnerable wireless operating systems are also affected by these security issues.

“To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage,” HPE notes.

The company says it is not aware of any of these vulnerabilities being exploited in the wild, but urges customers to apply the patches as soon as possible.

Related:iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Related:This Is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Related:Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems

Related:Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Genesys Hack Exposes Customer Data From Internal Systems
  • 953 Online Stores Infected in Long-Lasting Malware Campaign
  • Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
  • Mythos 5 Ignored Real-World Harm in July Attack
  • China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  • Attackers Exploit Third Arista VCO Zero-Day in Four Months
  • 11 Million Impacted by Capcom Data Breach
  • LiteLLM Compromised in Fresh Supply Chain Attack

Latest News

  • Unexplained DreamHost Incident Prompts Email, FTP Password Resets
  • iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
  • Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
  • This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
  • Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  • Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
  • Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
  • Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI

Trending

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

PHP2Shell Exploitation Moves From Probes to Working Shells

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

SecurityWeek Analysis: 178 Cybersecurity M&A Deals Announced in First Half of 2024

953 Online Stores Infected in Long-Lasting Malware Campaign

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Genesys Hack Exposes Customer Data From Internal Systems

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Cequence Security has appointed Russ Schafer as CMO.

Mona Harrington has been named Assistant Director for Cyber Integration at DHS.

iCOUNTER has appointed Mark H. FitzPatrick as CFO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)

Four Cyber Threats Harboring Big Plans for the Future

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)