HPE Patches 72 Aruba Networking Flaws, Including Eight Critical Bugs
Summary
HPE patched 72 vulnerabilities in Aruba AOS-8 and AOS-10, including eight max-severity flaws that could enable remote code execution or administrative access. HPE says it has no evidence of exploitation and urges customers to patch.
Key points
- The updates address 72 vulnerabilities: 33 critical, 31 high, eight medium, and one low severity.
- Eight max-severity flaws could allow unauthenticated remote code execution, authentication bypass, or administrative access.
- Fixed versions include AOS 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2.
- Affected products include compatible mobility conductors, controllers, gateways, access points, hardware, and virtual machines.
- HPE recommends restricting CLI and web management interfaces to dedicated network segments or controlling access with firewalls and accounting controls.
- HPE says it is not aware of exploitation in the wild and urges customers to apply the patches.
Article Details
- Vulnerability Types
- Remote code execution
- Authentication bypass
- Arbitrary command execution
- Severity
- Critical; eight vulnerabilities are described as maximum severity.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or control them with firewall policies at layer 3 and above.
- Use accounting controls to track and log user activities and resource usage.
CVE
CVE-2026-79844Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79845Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79846Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79847Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79848Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79849Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79850Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.CVE-2026-79851Vendor / Product unavailableThe security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.
Vendors
Products
AOS-10HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws.AOS-8HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws.