Aruba AOS Vulnerabilities: Eight CVSS 10.0 Flaws Patched
Security

Aruba AOS Vulnerabilities: Eight CVSS 10.0 Flaws Patched

HPE fixed 72 Aruba AOS vulnerabilities, eight rated CVSS 10.0, in AOS-8 and AOS-10. Not exploited yet. Fixed builds, affected trains and workarounds.

AB
Anthony Bahn IT Director & Cybersecurity Consultant
hpe arubawireless securityaos-8aos-10patch management

HPE has patched 72 Aruba AOS vulnerabilities in AOS-8 and AOS-10, the operating systems behind Aruba wireless controllers, Mobility Conductors, gateways and access points. Eight of the flaws carry a CVSS 3.1 score of 10.0 and need no login. Security bulletin HPESBNW05162 was published on 22 October 2026. No exploitation has been reported yet, but the fixes are now public. Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24, and fence off management and PAPI traffic until every controller is done.

What happened

HPE Networking released bulletin HPESBNW05162 revision 1 on 22 October 2026, covering 72 CVEs across its wireless operating systems. The CVE records for the critical flaws were published the same day by HPE as the CNA and updated on 23 October.

The eight maximum-severity bugs split across both platforms. All eight are rated network attack vector, low complexity, no privileges, no user interaction and changed scope. HPE's own wording is blunt: "Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," according to BleepingComputer.

HPE also said it "is not aware of any public discussion or exploit code that targets the listed vulnerabilities" as of release. None of the eight appear in the CISA Known Exploited Vulnerabilities catalog (checked against catalog version 2026.10.23).

Which Aruba AOS vulnerabilities are rated 10.0

AOS-10 (affected: 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6, 10.4.0.0 through 10.4.1.13):

  • CVE-2026-79844: authentication bypass leading to remote code execution. The CVE record says exploitation needs "certain preconditions outside of the attacker's control." HPE has not said what those are.
  • CVE-2026-79847: unauthenticated buffer overflow triggered by crafted packets sent to the affected interface, giving code execution as a privileged user.
  • CVE-2026-79851: a second unauthenticated buffer overflow leading to remote code execution.
  • A PAPI authentication bypass that BleepingComputer and the bulletin list as CVE-2026-79845 (see the note below).

AOS-8 (affected: 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23):

  • CVE-2026-79846: unauthenticated command injection, with the same "preconditions" qualifier as CVE-2026-79844.
  • CVE-2026-79848 and CVE-2026-79849: unauthenticated SQL injection that leads to command execution on the underlying operating system.
  • CVE-2026-79850: authentication bypass leading to command execution as root.

A note on CVE-2026-79845: the public CVE.org record under that number describes a SQL injection in an unrelated PHP inventory application, published in August by a different CNA. HPE's bulletin uses the same ID for its AOS-10 PAPI flaw. Expect a correction or a new ID. Until then, scanners and ticketing systems that look up 79845 will show the wrong product.

Who is affected

The bulletin covers AOS-8 and AOS-10 Mobility Conductors and Controllers, gateways managed through Aruba Central, AOS-10 access points and AOS-8 Instant APs. AOS-CX switches and Instant On gear are out of scope, per Safeguard's reading of the bulletin.

Three groups need extra attention:

  • Organizations on AOS-8.12, AOS-10.6 or AOS-10.3. The CSAF data folds these releases into the affected ranges, but there is no fixed build on those trains. Getting a fix means moving to a different release train.
  • Anyone on end-of-maintenance software. HPE says end-of-maintenance releases are "presumed to be affected" and will not be fixed. That includes AOS-8.11, 8.9 and older, and AOS-10.5 and older.
  • Teams relying on CPE-based scanners. At the time of Safeguard's analysis, NVD had not yet analyzed the records or assigned product identifiers, so automated tools may not flag these devices.

Technical analysis

The bulletin is unusually broad. By Safeguard's count, 58 of the 72 CVEs need no privileges, 42 are reachable over the network and 26 from an adjacent network. Twenty-two involve PAPI, ten the web management interface and eight the CLI.

PAPI is the Aruba control protocol that access points and controllers use to talk to each other, on UDP port 8211 (Instant AP clusters also use UDP 8209). It carries configuration downloads and control traffic. Because so many of the flaws sit in PAPI, any network segment where an attacker can reach UDP 8211 on a controller matters as much as the web login page. Our explainer on what Aruba PAPI is and why it is exposed covers the protocol in more detail.

Two scoring details are worth knowing for triage. CISA's SSVC enrichment rates the critical records as automatable with total technical impact, even though exploitation is currently "none." EPSS scores were low on 23 October, which is normal for a bug with no public exploit and says little about what happens once researchers diff the patched firmware.

HPE credits most findings to internal research. An external researcher, moonv, is credited on the two AOS-8 SQL injection flaws. HPE's previous AOS bulletin, HPESBNW05048 in May 2026, fixed 27 CVEs.

What to do now

  1. Inventory every AOS device and its train. Record platform (AOS-8 or AOS-10), exact build and role (conductor, controller, gateway, Instant AP). Do not rely on scanners for this one.
  2. Upgrade to a fixed build. The fixed releases are AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14, and AOS-8.13.3.1 and 8.10.0.24, or later. Devices on 8.12, 10.6, 10.3 or an end-of-maintenance release need a train change, which usually means a longer test cycle. Plan that now; our piece on why firmware release trains matter for patching walks through the decision.
  3. Restrict management access while you patch. HPE's workaround is to put the CLI and web management interfaces on a dedicated layer 2 segment or VLAN, or control them with layer 3 firewall policy. Block management protocols from client, guest and internet-facing networks. Our guide on how to restrict wireless controller management access covers the steps.
  4. Limit PAPI to the networks that need it. Allow UDP 8211 (and 8209 for Instant AP clusters) only from AP subnets and peer controllers.
  5. Turn on Control Plane Security on AOS-8. CPsec wraps AP-to-controller traffic in IPsec. It reduces exposure but does not fix the bugs.
  6. Log management activity. Enable command accounting and send logs to a central syslog or TACACS+ server so any later abuse leaves a trail.

If you already restrict management access to a jump host for other appliances, the same pattern applies here; see how to restrict firewall management access to a jump box.

What to watch next

  • A corrected CVE ID or record for the PAPI flaw now listed as CVE-2026-79845.
  • An explanation of the "preconditions" behind CVE-2026-79844 and CVE-2026-79846.
  • Public proof-of-concept code or patch-diff write-ups, which typically follow a bulletin of this size within weeks.
  • Any CISA KEV listing, which would set a federal deadline and signal confirmed exploitation.
  • Whether HPE issues a one-off fix for AOS-8.12, as it did with 8.12.0.7 after the May bulletin.

Sources

← Back to all news