HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws.
The security updates address eight max-severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851.
Successful exploitation of these security defects could allow unauthenticated attackers to achieve remote code execution (RCE), bypass authentication to gain administrative privileges, run arbitrary commands, and completely compromise the affected systems.
HPE Networking’s AOS versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2 contain fixes for all eight bugs and have been rolled out across mobility conductor, controller, gateway, and access point products.
The remaining critical-severity issues resolved with the updates could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access, and complete system compromise, HPE notes in its advisory.
HPE also resolved 31 high-severity vulnerabilities across its networking products, including over a dozen that could be exploited without authentication, eight medium-severity flaws, and one low-severity weakness.
The company notes that all “hardware, mobility solutions (such as conductors, controllers, and gateways), access points, or virtual machines (VMs)” that are compatible with the vulnerable wireless operating systems are also affected by these security issues.
“To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage,” HPE notes.
The company says it is not aware of any of these vulnerabilities being exploited in the wild, but urges customers to apply the patches as soon as possible.
Related: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Related: This Is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Related: Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Related: Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
