- HPE Networking patched AOS-8 and AOS-10, including eight flaws scored 10.0 on CVSS v3.1. At release, HPE knew of no exploit code.
- For seven of the eight, HPE says only "the affected interface". Other flaws are tied to web management, SSH, the command line or the PAPI protocol.
- HPE urges patching and, as a paired step, limiting command-line and web management access. Ask your team which AOS devices you run.
Eight top scores, and an exposure point HPE leaves unnamed
After a large advisory, every network team asks the same question: where exactly can an attacker get in? HPE's latest advisory for Aruba wireless software answers that only in part.
HPE Networking has released patches for AOS-8 and AOS-10, the operating systems behind Aruba mobility conductors, controllers, gateways and access points. The advisory includes eight flaws with a CVSS v3.1 base score of 10.0, from CVE-2026-79844 through CVE-2026-79851. BleepingComputer reports that the update fixes 72 vulnerabilities in total.
This shows the gap between a severity score and a map. A 10.0 reflects both how bad an attack would be and how easy it is: these flaws can be reached over the network with no login. It does not tell you which service or interface to lock down. For seven of the eight, HPE writes only "the affected interface". The eighth, CVE-2026-79845, is in the PAPI protocol.
What the eight flaws are
All eight are described as exploitable by an unauthenticated remote attacker. The scoring vectors describe attacks over the network, of low complexity, needing no privileges and no user interaction.
They cover several kinds of error. CVE-2026-79844 and CVE-2026-79850 are authentication bypasses that lead to command execution, in AOS-10 and AOS-8. CVE-2026-79845 is a bypass in AOS-10's PAPI protocol. CVE-2026-79846 is command injection in AOS-8. CVE-2026-79847 and CVE-2026-79851 are buffer overflows in AOS-10. CVE-2026-79848 and CVE-2026-79849 are SQL injection in AOS-8.
HPE says two of them, CVE-2026-79844 and CVE-2026-79846, need certain preconditions outside the attacker's control. For CVE-2026-79850, HPE says an attacker could run commands as root, which it describes as complete system compromise.
Where the advisory does name the exposure
Some flaws in the wider advisory are tied to specific components. CVE-2026-79852, scored 9.8, is SQL injection in the web-based management interface. For CVE-2026-79855, also scored 9.8, HPE says an unauthenticated remote attacker could skip the login on the SSH service of AOS-8 and gain administrative privileges. CVE-2026-79871, scored 9.6, sits in the command line interface of AOS-10. HPE says it could expose sensitive information that might help an attacker reach other network services.
PAPI is Aruba's access point management protocol. CVE-2026-79860, scored 9.8, involves specially crafted packets sent to PAPI's UDP port 8211. It is not among the eight scored 10.0.
The error types are familiar. A buffer overflow sends more data than a program expects, which can let an attacker run their own code. SQL injection tricks a program into treating input as database commands. Command injection does the same with the operating system. An authentication bypass skips the login altogether.
Other flaws are scored 9.6 and need an "adjacent" attacker. That means someone on the same local network segment as the device.
Patch and restrict access: HPE asks for both
HPE's advice has two parts. It says customers are "strongly urged to patch" because of the complexity, breadth and impact of the flaws.
Separately, to minimise the likelihood of exploitation, HPE recommends restricting the command-line and web-based management interfaces. It suggests a dedicated layer 2 segment or VLAN, or firewall policies at layer 3 and above. It adds accounting controls to track and log user activity.
The sources do not say that restricting access can stand in for patching, or that it comes first. The advisory also does not say whether that step covers PAPI or the interfaces it leaves unnamed.
Our interpretation: treat the two as layers. A patch removes the known flaws. Tighter access cuts the number of people and devices that can try to reach a management function. Neither is a reason to delay the other.
Good news, and its limits
HPE says it found the flaws mostly through its own research. It credits some to outside researchers in its bug bounty programme, including moonv for CVE-2026-79848 and CVE-2026-79849.
HPE says that when it published the advisory, no exploit code or public talk about these flaws had come to its attention. BleepingComputer reports that HPE has also found no sign of attacks in the wild. Both statements apply to the release date. They say nothing about later days.
The advisory also hints at scale. The entry for CVE-2026-79862 and CVE-2026-79863 lists more than 30 internal tracking references, and HPE does not explain them. One reading is that a single CVE ID can cover many separate findings. If so, the CVE count may understate the work behind this update.
Who is affected
HPE says any compatible hardware, conductor, controller, gateway, access point or virtual machine running the affected versions is vulnerable. Its model list is illustrative and incomplete. Teams cannot rely on it to rule themselves out.
BleepingComputer notes that HPE serves more than 55,000 enterprise customers, including 90% of the Fortune 500. The report does not say how many run AOS.
It also recalls earlier HPE issues, including a maximum-severity OneView flaw that CISA flagged as exploited in January 2025. Those are different products. They do not show a pattern in AOS.
Questions for your network team
First, which AOS-8 and AOS-10 devices do we run, and on which versions? Check this inventory directly, because the advisory's model list is not complete.
Second, what is the patch plan and date? HPE's urging is the clearest instruction in the advisory.
Third, can the command-line and web management interfaces be reached from user or guest networks today? If so, what would it take to move them behind a dedicated segment or firewall policy, with activity logging?
Fourth, have we asked HPE which interface each of the unnamed flaws touches? Until that is clear, you cannot be sure a single control covers all eight.
The advisory asks for two actions, and the safest reading is to do both.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Hewlett Packard Enterprise (HPE).
