Overview
Hewlett Packard Enterprise released security updates for 72 vulnerabilities in ArubaOS, including eight rated maximum severity. The critical flaws are authentication bypass and code execution issues that remote, unauthenticated attackers can exploit with low complexity and no user interaction.
Maximum-Severity Flaws
| CVE | Flaw type | Branch |
|---|---|---|
| CVE-2026-79844 | Authentication bypass leading to RCE | AOS-10 |
| CVE-2026-79845 | Authentication bypass in the PAPI protocol | AOS-10 |
| CVE-2026-79846 | Unauthenticated command injection | AOS-8 |
| CVE-2026-79847 | Unauthenticated buffer overflow leading to RCE | AOS-10 |
| CVE-2026-79848 | Unauthenticated SQL injection leading to RCE | AOS-8 |
| CVE-2026-79849 | Unauthenticated SQL injection leading to RCE | AOS-8 |
| CVE-2026-79850 | Authentication bypass leading to RCE | AOS-8 |
| CVE-2026-79851 | Unauthenticated buffer overflow leading to RCE | AOS-10 |
The flaws affect multiple AOS-8 and AOS-10 software versions. Exact affected and fixed versions are in HPE advisory hpesbnw05162en_us.
Exploitation Status
HPE says it is not aware of public discussion or exploit code for these vulnerabilities, and there is no reported in-the-wild exploitation. Given the unauthenticated nature of the bugs and the past targeting of network infrastructure, expect researchers and attackers to reverse the patches quickly.
Mitigation
- Patch as soon as possible using the fixed releases in HPE's advisory.
- Where patching is delayed, restrict access to the CLI and web management interfaces by placing them on a dedicated layer 2 segment or VLAN, and/or controlling access with layer 3+ firewall policies.
- Enable accounting controls to track and log user activity and resource usage.
- Review controller and gateway logs for unexpected PAPI traffic or administrative sessions.