HPE ArubaOS: 72 vulnerabilities patched, including eight max-severity unauthenticated RCE and auth bypass flaws (CVE-2026-79844 through CVE-2026-79851)
Severity: critical · Patch status: patched · Since 2026-10-23 · CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851
HPE released security updates on 2026-10-23 fixing 72 vulnerabilities in ArubaOS, the OS powering Aruba enterprise wireless infrastructure (controllers, gateways, access points, mobility conductors). Eight are maximum-severity, remotely exploitable without privileges via low-complexity attacks requiring no user interaction: authentication bypasses leading to RCE (CVE-2026-79844, CVE-2026-79850), PAPI protocol auth bypass (CVE-2026-79845), unauthenticated command injection (CVE-2026-79846), buffer overflows leading to RCE (CVE-2026-79847, CVE-2026-79851), and SQL injections leading to RCE (CVE-2026-79848, CVE-2026-79849). Multiple AOS-8 and AOS-10 versions are affected. HPE says no public exploit code or in-the-wild exploitation is known. Patches are available; HPE urges immediate patching and restricting management interfaces.
What to do
- Patch affected AOS-8 and AOS-10 devices immediately, prioritising the eight maximum-severity CVEs
- Until patched, restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and enforce layer 3+ firewall policies
- Enable accounting controls for logging and tracking user activity on management interfaces
- Check for signs of compromise on internet-exposed or previously unmanaged Aruba devices
- Review HPE's advisory for full affected-version lists and any additional mitigations
Sources
All live incidents on Threat Watch
