HPE patches eight max severity RCE and auth bypass AOS flaws

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices. The eight maximum-severity security flaws patched today affect multiple AOS-8 and AOS-10 software versions, and they can be exploited by remote threat actors without privileges through low-complexity attacks that don't require user interaction. HPE warned customers to patch these security issues as soon as possible and provided mitigation measures, including restricting access to AOS management interfaces. "Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," the company warned in a Thursday security advisory. "To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage." The full list of maximum severity flaws fixed today can be found in the table embedded below: CVE-ID Vulnerability CVE-2026-79844 Authentication Bypass Leading to RCE in AOS-10 CVE-2026-79845 Authentication Bypass in the PAPI Protocol of AOS-10 CVE-2026-79846 Unauthenticated Command Injection in AOS-8 CVE-2026-79847 Unauthenticated Buffer Overflow leads to RCE in AOS-10 CVE-2026-79848 Unauthenticated SQL Injection leading to RCE in AOS-8 CVE-2026-79849 Unauthenticated SQL Injection leading to RCE in AOS-8 CVE-2026-79850 Authentication Bypass leading to RCE in AOS-8 CVE-2026-79851 Unauthenticated Buffer Overflow leading to RCE in AOS-10 The company added that it has not yet found publicly available proof-of-concept exploit code or evidence that these vulnerabilities are being exploited in the wild. "HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory," it said. In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution and, one month later, warned of hardcoded credentials in Aruba …