Eight flaws rated 10 out of 10 threaten HPE's Aruba enterprise Wi-Fi

Seventy-two flaws at once. That is the content of security bulletin HPESBNW05162, published on October 22 by HPE for AOS-8 and AOS-10. These two systems run the enterprise Wi-Fi of its Aruba brand: access points, controllers, gateways and central management consoles (“Mobility Conductors”). Eight of these flaws receive the maximum severity score, 10 out of 10.

According to BleepingComputer, all eight flaws can be exploited remotely, without an account and without any user interaction. HPE notes, however, that two of them (CVE-2026-79844 and CVE-2026-79846) can only be exploited if certain preconditions are met. The good news: HPE says it is not aware of “any public discussion or exploit code” targeting these flaws as of the date of its bulletin. The vendor nonetheless “strongly” urges its customers to patch, because of “the complexity, scope and impact” of these vulnerabilities.

What the eight most serious flaws would allow

Four affect AOS-10. Two are authentication bypasses, one of which leads to code execution and the other affects PAPI, the protocol access points and controllers use to communicate. The other two are memory overflows leading to code execution (CVE-2026-79844, CVE-2026-79845, CVE-2026-79847, CVE-2026-79851).

The other four affect AOS-8: an unauthenticated command injection, two SQL injections and an authentication bypass, the last three of which can lead to code execution (CVE-2026-79846, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850).

Why is this serious? A Wi-Fi controller sees users' traffic and usually connects to the internal network. An attacker who took control of one would have an ideal foothold to go further.

Versions to install

• AOS-10: 10.8.1.2, 10.7.2.7 or 10.4.1.14 (or a later version), depending on the branch in use;
• AOS-8: 8.13.3.1 or 8.10.0.24 (or a later version).

The 10.6, 10.3 and 8.12 branches are affected but have no patch of their own: you must move to one of the versions above. Versions that are no longer maintained should be considered vulnerable and will not be patched. According to the bulletin, HPE's other networking products are not affected.

In the meantime, take administration off open networks

Updating a fleet of access points spread across several sites often requires a maintenance window. For the interim period, HPE recommends restricting access to administration interfaces, both command-line and web, to a dedicated network segment or VLAN, filtering that access with firewall rules, and logging account activity.

Three habits, advised by the analysis firm Rescana, complete these measures. First, the PAPI protocol port (UDP 8211) must not be reachable from guest or shared networks. Second, review administration logs for unexpected logins, accounts or configuration changes. Finally, for gateways managed from the HPE Aruba Networking Central online console, the bulletin does not say whether HPE applies the update itself, notes Rescana: it is better to check the installed version than to assume.

No attacks have been reported so far, then. But a bulletin this detailed also serves as a map for attackers, and the delay between patch and exploitation is sometimes counted in weeks, as the Plex media server flaws, patched in September and exploited in October, have shown. Worth watching: the release of exploit code and the possible addition of these flaws to the US agency CISA's catalog of exploited vulnerabilities.