Overview
HPE has released patches for 72 vulnerabilities in its Aruba Networking products running the AOS-8 and AOS-10 wireless operating systems. Of these, 33 are critical, 31 high, 8 medium, and 1 low.
Eight of the critical issues, CVE-2026-79844 through CVE-2026-79851, are rated maximum severity. Per SecurityWeek, they could let unauthenticated attackers achieve remote code execution, bypass authentication for administrative access, and run arbitrary commands, leading to full system compromise.
HPE says it is not aware of any of these vulnerabilities being exploited in the wild.
Affected Products
- Mobility conductors and controllers
- Gateways
- Access points
- Virtual machines and compatible hardware running AOS-8 or AOS-10
Other critical flaws in the batch can lead to information disclosure and file tampering.
Fixed Versions
| Branch | Fixed release |
|---|---|
| AOS-8 | 8.10.0.24, 8.13.3.1 |
| AOS-10 | 10.4.1.14, 10.7.2.7, 10.8.1.2 |
Mitigation
HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, or protecting them with layer 3 and higher firewall policies. Enabling accounting controls to log user activity is also advised.
Recommended Actions
- Inventory all Aruba controllers, gateways, and access points and record their AOS versions.
- Schedule upgrades to the fixed releases above, starting with controllers reachable from untrusted networks.
- Move management interfaces onto an isolated management VLAN now, before patching completes.
- Review controller logs for unexpected administrative logins or configuration changes.
Networking vendors' bulk advisories are frequently reverse-engineered quickly, so treat the unexploited status as temporary.