Vulnerabilities

HPE patches eight max-severity ArubaOS bugs that let an attacker take over Aruba Wi-Fi gear without logging in

Hewlett Packard Enterprise released fixes for 72 vulnerabilities in ArubaOS (AOS), the operating system on Aruba Networking mobility conductors, controllers, gateways and access points. Eight are rated maximum severity: authentication bypasses, command injection, SQL injection and buffer overflows that a remote attacker can use to run code with no account and no user interaction, across both AOS-8 and AOS-10. HPE says it has seen no public exploit code and no attacks so far.

Oct 23, 2026 · 2 min read

The eight critical bugs are CVE-2026-79844 through CVE-2026-79851. Four sit in AOS-10, including an authentication bypass in PAPI, the internal protocol Aruba devices use to talk to each other. The other four hit AOS-8, including two SQL injection flaws that lead to code execution. HPE's advisory tells customers to patch "due to the complexity, breadth, and impact of these vulnerabilities."

Why this one matters: a wireless controller sees every laptop and phone on the corporate network and usually holds the keys to how users sign in to Wi-Fi. Taking one over gives an attacker a quiet place to watch traffic and move sideways, and these boxes rarely run endpoint security. Network edge gear has been the favorite way in this year, including the Arista VeloCloud zero-day attackers are exploiting right now, so "not exploited yet" usually doesn't last long after a patch lets researchers compare old and new code.

What I'd do today if I ran the network team: find every AOS-8 and AOS-10 device, including the conductors people forget about, and schedule the upgrade. Until then, do what HPE recommends and keep the CLI and web admin pages on a dedicated management network (a separate VLAN) behind a firewall, so a regular user or guest device can't even reach them. Then check admin login logs for anything you don't recognize.

Sources

BleepingComputer: HPE patches eight max severity RCE and auth bypass AOS flaws, Oct 23, 2026 (quotes HPE's Oct 22 security advisory)

HPE just patched 72 bugs in ArubaOS, the software running Aruba Wi-Fi controllers, gateways and access points. Eight are max severity: no login, no clicks, straight to running code. No attacks seen yet. If your Aruba management interface is reachable from user networks, lock it down today and patch.