Vulnerabilities

HPE Aruba AOS: 72 flaws, eight rated 10.0, patch now

By Yaali. October 29, 2026, 6 min read, Vulnerabilities, Patching.

HPE fixed 72 flaws in Aruba AOS-8 and AOS-10, eight of them CVSS 10.0 with no login needed. Fixed builds, upgrade order, exposure and compromise checks.

On October 22, HPE published security bulletin HPESBNW05162, which fixes 72 vulnerabilities in the wireless operating systems of its Aruba line, AOS-8 and AOS-10. Thirty-three are rated critical, and eight of those score the maximum CVSS 10.0: an attacker with no account can run commands on the device or take administrative control. The bulletin covers Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 access points and AOS-8 Instant access points.

You are affected if any of these runs AOS 10.8.1.1, 10.7.2.6, 10.4.1.13, 8.13.3.0, 8.10.0.23 or anything older on those branches. HPE says it knows of no public exploit code or discussion, which leaves a window to patch before someone reverses the fixes. Controllers sit on every wireless VLAN and hold the keys to Wi-Fi authentication, which is why this should not wait for the next quarterly window.

The numbers, and one discrepancy

SecurityWeek reported the release on October 27 with 33 critical, 31 high, eight medium and one low. Those figures add up to 73, not 72. The bulletin itself lists seven medium-severity CVEs, so its own breakdown of 33, 31, 7 and 1 does total 72, and that is the set we use here.

By our count of the bulletin's CVSS vectors, 33 of the 72 can be reached over the network with no credentials, and 24 more need no credentials but require the attacker to be on an adjacent network, such as a client VLAN or the segment shared by access points and controllers. Most were found by HPE's internal security research, with several credited to its bug bounty program.

How it works

The eight maximum-severity flaws, CVE-2026-79844 to CVE-2026-79851, all carry a "scope changed" CVSS vector, meaning a successful attack reaches beyond the vulnerable service into the underlying operating system. HPE describes them as follows:

• CVE-2026-79844 (AOS-10) and CVE-2026-79850 (AOS-8): authentication bypass that leads to running commands on the host, as root in the AOS-8 case.
• CVE-2026-79845 (AOS-10): authentication bypass in the PAPI protocol that gives administrative access, configuration changes and access to sensitive data.
• CVE-2026-79846 (AOS-8): unauthenticated command injection.
• CVE-2026-79847 and CVE-2026-79851 (AOS-10): buffer overflows that give code execution as a privileged user.
• CVE-2026-79848 and CVE-2026-79849 (AOS-8): unauthenticated SQL injection that ends in operating system commands.

For most of these, HPE names only "the affected interface". It adds that CVE-2026-79844 and CVE-2026-79846 work only "if certain preconditions outside of the attacker's control are met" and does not say what those are.

PAPI is the protocol Aruba access points and controllers use to talk to each other, on UDP port 8211. It is the single biggest cluster in the bulletin: 21 CVEs, from authentication bypasses to command injection and buffer overflows reached by "specially crafted packets destined to the PAPI UDP port 8211". Because PAPI is UDP and answers before any login, any host that can send packets to 8211 on a controller or access point can reach that code. The rest spread over the web management interface, the CLI, the API, Wi-Fi frame processing and the SSH daemon. CVE-2026-79855 (CVSS 9.8) is an authentication bypass in the AOS-8 SSH daemon that gives administrative privileges.

What attackers are doing

Nothing reported yet. HPE says it is "not aware of any public discussion or exploit code" as of the release, and neither SecurityWeek nor the Canadian Centre for Cyber Security reports exploitation. Once fixed builds are public, attackers can compare them with older builds to find the bugs, so controllers reachable from guest networks or the internet should go first.

What to do

1. Know what you run

On each Mobility Conductor or standalone controller, show version gives the running build. On an AOS-8 conductor, show switches lists every managed controller with its version. For Instant APs, run show version on the virtual controller. AOS-10 gateways and access points report their firmware in Central. Anything on a branch outside the five fixed ones is past End of Maintenance; HPE presumes those builds are affected and will not fix them, so they need a move to a supported branch.

2. Find what is exposed

From a guest VLAN, a user VLAN and the internet, test whether you can reach controllers on TCP 22 (SSH), TCP 4343 (the AOS web interface) and UDP 8211 (PAPI). For example, nmap -sU -p 8211 <controller> and nmap -p 22,4343 <controller>. Management should answer only from your admin network, and PAPI only from the access point and controller subnets.

3. Upgrade in order

The fixed builds are AOS 10.8.1.2, 10.7.2.7 and 10.4.1.14, and AOS 8.13.3.1 and 8.10.0.24, or later on the same branch. In AOS-8, a Mobility Conductor must run the same or a newer release than the controllers it manages, so upgrade the conductor first, then the managed controllers. Campus access points take their image from the controller when they rejoin. Clustered controllers can use the cluster Live Upgrade feature to keep clients connected. For Instant APs, upgrade through the virtual controller. For AOS-10, schedule gateways and access points from Central's firmware management.

4. If you cannot patch this week

Apply HPE's workaround: keep the CLI and web management interfaces on a dedicated layer 2 segment or VLAN, filter them with layer 3 firewall policy, and turn on accounting so admin activity is logged. On AOS-8 controllers, a control plane ACL (firewall cp) can limit SSH and port 4343 to the management subnet whatever the interface layout, and show firewall-cp shows hit counters. Block UDP 8211 at the internet edge and between user VLANs and the controllers. None of this touches the adjacent-network flaws on segments access points must use, so it buys time only.

5. Check for compromise

• Run show mgmt-user and remove any local admin account you cannot account for.
• Review show audit-trail for configuration changes nobody made: new admins, changed RADIUS servers, new SSIDs or altered firewall roles.
• Compare the running configuration with your last known-good backup.
• Look in your syslog server for admin logins from unexpected addresses or at odd hours. Copies held off the box matter, because an attacker with root can edit local logs.

If anything looks wrong, reimage onto a fixed build and rotate everything the controller held: admin passwords, RADIUS and TACACS+ shared secrets, Wi-Fi pre-shared keys, SNMP communities and any certificates with private keys on the device.

The wider lesson

Wireless controllers rarely get the patch urgency of firewalls and VPN gateways, yet they terminate every Wi-Fi session and hold the RADIUS secrets for the network. A bulletin where 57 of 72 flaws need no login is a good moment to check that management and PAPI are filtered by design and that controller logs leave the box.

Our network penetration tests check what management interfaces, controllers included, answer from guest and user networks, and our safeguarding and hardening work puts the ACLs and logging in place. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: HPE security bulletin HPESBNW05162, SecurityWeek, Canadian Centre for Cyber Security AV26-1079, HPE Aruba Networking AOS-8 Live Upgrade documentation.