HPE patched eight max-severity flaws in ArubaOS. Most need no login at all.
By Lior AharonovFounder, 7IT Solutions ·
What happened
HPE released fixes for eight maximum-severity vulnerabilities in ArubaOS, BleepingComputer reported on 23 October 2026: four in AOS-10 (CVE-2026-79844, -79845, -79847, -79851) and four in AOS-8 (CVE-2026-79846, -79848, -79849, -79850). They include unauthenticated command injection, SQL injection, buffer overflows and authentication bypasses that lead to remote code execution.
Why it matters
ArubaOS runs the controllers, gateways and access points your office depends on, and whoever owns that box sees the traffic between your developers and everything they deploy. HPE says no public exploit code was known at release. That window does not stay open long.
What to do
If you run Aruba controllers, gateways or access points, read HPE advisory hpesbnw05162en_us and patch. Until then, keep the CLI and web management interfaces on a dedicated VLAN or behind firewall rules.
No exploit yet is a countdown, not a reprieve. Patch while the clock is still on your side.
Lior Aharonov · my takeSources
| HPE patches eight max-severity RCE and auth bypass AOS flaws (BleepingComputer) | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.