Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.
Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices.
The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don’t require user interaction.
HPE warned customers to patch these security issues as soon as possible and provided mitigation measures, including restricting access to AOS management interfaces.
“Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities,” the company warned in a Thursday security advisory.
“To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage.”
The full list of maximum severity flaws fixed today can be found in the table embedded below:
| CVE-ID | Vulnerability |
| CVE-2026-79844 | Authentication Bypass Leading to RCE in AOS-10 |
| CVE-2026-79845 | Authentication Bypass in the PAPI Protocol of AOS-10 |
| CVE-2026-79846 | Unauthenticated Command Injection in AOS-8 |
| CVE-2026-79847 | Unauthenticated Buffer Overflow leads to RCE in AOS-10 |
| CVE-2026-79848 | Unauthenticated SQL Injection leading to RCE in AOS-8 |
| CVE-2026-79849 | Unauthenticated SQL Injection leading to RCE in AOS-8 |
| CVE-2026-79850 | Authentication Bypass leading to RCE in AOS-8 |
| CVE-2026-79851 | Unauthenticated Buffer Overflow leading to RCE in AOS-10 |
The company added that it has not yet found publicly available proof-of-concept exploit code or evidence that these vulnerabilities are being exploited in the wild.
“HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory,” it said.
In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution and, one month later, warned of hardcoded credentials in Aruba Instant On Access Points that can let attackers bypass device authentication.
In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also flagged a maximum-severity HPE OneView vulnerability as exploited in attacks.
More recently, HPE warned of critical flaws allowing admin password resets and remote code execution on unpatched AOS-CX devices.
HPE employs more than 61,000 people worldwide and provides services and products to over 55,000 enterprise customers worldwide, including 90% of Fortune 500 companies.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
