HPE Patches Eight Critical RCE and Authentication Bypass Flaws in ArubaOS
Summary
HPE patched 72 ArubaOS vulnerabilities, including eight maximum-severity flaws affecting AOS-8 and AOS-10 that could allow unauthenticated remote code execution. HPE reported no known public exploit code or in-the-wild exploitation.
Key points
- The eight maximum-severity flaws affect multiple ArubaOS 8 and ArubaOS 10 versions and could be exploited remotely without privileges or user interaction.
- The flaws include authentication bypass, command injection, buffer overflow, and SQL injection issues.
- The affected CVEs are CVE-2026-79844 through CVE-2026-79851.
- HPE urged customers to apply the security updates promptly.
- HPE recommends restricting CLI and web management interfaces to a dedicated network segment or controlling access with firewall policies.
- HPE said it was not aware of public exploit code or evidence of exploitation in the wild at the advisory's release.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Command injection
- Buffer overflow
- SQL injection
- Severity
- Maximum severity
- Affected Versions
- ArubaOS AOS-8
- ArubaOS AOS-10
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Restrict CLI and web-based management interfaces to a dedicated Layer 2 segment/VLAN and/or control access with firewall policies at Layer 3 and above.