HPE Aruba AOS-8 and AOS-10 patches 72 flaws, eight at CVSS 10.0 (HPESBNW05162)

HPE has published security bulletin HPESBNW05162, which fixes 72 vulnerabilities in the AOS-8 and AOS-10 operating systems that run its Aruba-heritage Wi-Fi controllers, gateways and access points. Eight of them carry the maximum CVSS score of 10.0, and most can be reached without a login. HPE says it knows of no public exploit code or discussion, but an advisory this broad on network-edge equipment is the kind that attackers diff against patches within days, so administrators should plan upgrades now.

Key points

• HPE's bulletin HPESBNW05162, dated 22 October 2026, covers 72 CVEs in HPE Networking AOS-8 and AOS-10 (Mobility Conductors, Mobility Controllers, Mobility Gateways and access points).
• Eight flaws are rated CVSS 10.0: CVE-2026-79844 to CVE-2026-79851, a mix of authentication bypass, command injection, SQL injection and buffer overflows leading to remote code execution.
• Fixed releases are AOS-10 10.8.1.2, 10.7.2.7 and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24.
• HPE says it is not aware of public discussion or exploit code; no exploitation has been reported.
• If you cannot patch at once, HPE advises restricting the CLI and web management interfaces to a dedicated Layer 2 segment or VLAN and applying firewall policy at Layer 3 and above.

What to do

Who is affected. Compatible hardware and virtual machines running AOS-8 or AOS-10, including Mobility Conductors, Mobility Controllers, centrally managed Mobility Gateways, AOS-10 access points and AOS-8 Instant access points. According to CyberPress's reading of the bulletin, the vulnerable releases are AOS-8 8.13.3.0 and earlier (8.13 branch) and 8.10.0.23 and earlier (8.10 branch), and AOS-10 10.8.1.1, 10.7.2.6 and 10.4.1.13 and earlier within their branches. GBHackers lists the same ranges.

Fixed versions. Upgrade to the release for your branch, or a later one:

• AOS-10: 10.8.1.2, 10.7.2.7 or 10.4.1.14
• AOS-8: 8.13.3.1 or 8.10.0.24

Software beyond its maintenance period is presumed affected unless HPE says otherwise; HPE has not assessed releases past support, so those devices need a migration, not a wait.

Check your exposure. Inventory every controller, gateway and access point and note the running version. Confirm that management interfaces (SSH, the web UI, CLI) are not reachable from user networks or the internet. Several of the flaws are in PAPI, the access-point management protocol, which listens on UDP port 8211, so check that this port is filtered between networks that don't need it.

If you can't patch yet. Follow HPE's mitigation: put management on a dedicated Layer 2 segment or VLAN, add Layer 3+ firewall rules, and turn on accounting so user activity and resource use are logged. HPE and the outlets covering it are clear that these steps reduce exposure but do not replace the fix.

What happened

HPE released the bulletin, titled "Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)", on Thursday 22 October 2026. BleepingComputer, which reported the story on 23 October, counts 72 vulnerabilities, eight of them at the maximum severity. Daily CyberSecurity (securityonline.info) gives a breakdown in its body text of 32 critical, 31 high, 8 medium and 1 low, though its own summary line says 34 critical; the bulletin itself was not readable for us, so we do not quote a single severity breakdown beyond the eight 10.0 scores that every outlet agrees on.

The eight CVSS 10.0 flaws, as listed by BleepingComputer and described by CyberPress and Daily CyberSecurity:

CVE	Line	Type
CVE-2026-79844	AOS-10	Authentication bypass that can lead to command execution when certain preconditions outside the attacker's control are met
CVE-2026-79845	AOS-10	Authentication bypass in the PAPI protocol, giving administrative access
CVE-2026-79846	AOS-8	Unauthenticated command injection
CVE-2026-79847	AOS-10	Unauthenticated buffer overflow leading to remote code execution
CVE-2026-79848	AOS-8	Unauthenticated SQL injection leading to code execution
CVE-2026-79849	AOS-8	Unauthenticated SQL injection leading to code execution
CVE-2026-79850	AOS-8	Authentication bypass that runs commands as root
CVE-2026-79851	AOS-10	Unauthenticated buffer overflow leading to remote code execution

Below the top tier there are many more serious bugs. CVE-2026-79855, an authentication bypass in the AOS-8 SSH daemon, is rated 9.8 and could give an unauthenticated remote attacker administrative privileges. GBHackers describes it as exploitable over the network with low complexity and no user interaction. CVE-2026-79857 and CVE-2026-79860 are PAPI flaws, a command injection and buffer overflows reached by sending crafted packets to UDP port 8211. Daily CyberSecurity counts 58 of the 72 as requiring no login; of those, 32 are reachable over the network and 25 need an attacker on an adjacent network such as the same Wi-Fi or LAN segment, with one needing physical access.

HPE says most of the issues were found by its own networking security researchers. Bugcrowd researchers (named by Daily CyberSecurity as moonv, LIUPENG and zzcentury), two further individual researchers and a Siemens Energy team are credited for others.

Background

Wireless controllers and gateways sit in the path of user traffic and often hold credentials, so bugs there are valuable. HPE has patched Aruba-line products repeatedly: BleepingComputer's report recalls eight critical StoreOnce flaws in June 2025, hardcoded credentials in Aruba Instant On access points in July 2025, a maximum-severity OneView flaw that CISA flagged as exploited in January 2025, and, recently, critical AOS-CX flaws allowing admin password resets and remote code execution. Those are separate product lines; this bulletin concerns the AOS-8 and AOS-10 wireless operating systems.

Daily CyberSecurity calls PAPI a recurring target, which is one reason its UDP port is worth checking on your firewalls.

How the attacks work

The bulletin's flaws fall into familiar groups: authentication bypass (CWE-288 in Daily CyberSecurity's table), command and SQL injection (CWE-89), and buffer overflows (CWE-119), plus path traversal, information disclosure, cross-site scripting, file manipulation and denial of service in the lower tiers. Most of the high and critical items, HPE warns, let an attacker "execute arbitrary code as a privileged user on the underlying operating system", which on a controller means control of the device that authenticates and routes client traffic.

For CVE-2026-79844 and CVE-2026-79846, HPE attaches a condition: exploitation works only if certain preconditions outside the attacker's control are met. We don't know what those preconditions are; the bulletin text we could reach through secondary reports doesn't say, and administrators should read HPE's own advisory.

What it means

For network teams the size of the bulletin is the story. Seventy-two CVEs in one release means the safe fix is to upgrade the whole fleet to the named releases, not to hunt for the one flaw that applies to your configuration. For managed-service providers and campus or hospital networks, controllers are shared infrastructure, so one unpatched controller can expose many sites.

The mitigation HPE gives is the standard hardening advice for appliances, and it matters beyond this bulletin: management planes should never be on user networks. Organisations that already isolate management on a separate VLAN are in a far better position than those that expose the web UI broadly, even though HPE stresses these measures don't replace patching.

Because HPE found most of the flaws internally and says no exploit code is public, defenders have a head start. That head start can shrink once researchers compare patched and unpatched builds, so do not treat it as time to spare.

What we don't know yet

• Whether any of the flaws are being exploited. HPE says it knows of no public discussion or exploit code at release; CyberPress points out that this does not prove no exploitation has occurred.
• The exact CVSS vectors and preconditions for each CVE. We could not open HPE's support page (it needs a browser session), so the CVE details above come from BleepingComputer, Daily CyberSecurity, CyberPress and GBHackers, which agree on the CVE IDs, fixed versions and mitigations. Daily CyberSecurity's severity totals are internally inconsistent (32 vs 34 critical), so we leave them out.
• Which end-of-support releases are vulnerable. HPE has not assessed them.

What to watch next

Watch HPE's security bulletin page for revisions, CISA's Known Exploited Vulnerabilities catalogue for any of these CVE IDs, and proof-of-concept releases from researchers. If you run AOS, schedule the upgrade window this week and check firewall rules for UDP 8211 now.

For how to read a "10.0", see what a CVSS score means.

Sources

• BleepingComputer: HPE patches eight max severity RCE and auth bypass AOS flaws
• HPE bulletin HPESBNW05162
• Daily CyberSecurity: HPE Patches 72 Flaws in AOS-8 and AOS-10
• CyberPress: Critical HPE Aruba AOS-8 Vulnerability Allows Unauthenticated Network Attacks
• GBHackers: Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication