HPE Patches Dozens of Critical Flaws in Networking Products

What it is

HPE Networking patched 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems used by Aruba products. The severity split is 33 critical, 31 high, 8 medium and 1 low. Eight of the critical bugs are CVE-2026-79844 through CVE-2026-79851. The page says "last week" without giving a date.

Preconditions / Affected

HPE says all hardware, mobility solutions (conductors, controllers, gateways), access points and virtual machines that are compatible with the vulnerable wireless operating systems are affected. The fixed builds for the eight max-severity bugs are AOS 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2, and they are available for conductor, controller, gateway and access point products.

The other 25 critical issues could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access and full system compromise. Over a dozen of the 31 high-severity flaws can be exploited without authentication. The page does not map these to individual CVE ids or say which fixed build covers them.

What to do

Apply the fixed AOS build for your branch as soon as possible. HPE is not aware of exploitation in the wild, but urges prompt patching.

Until patched, HPE recommends two controls for the CLI and web management interfaces:

• Restrict them to a dedicated layer 2 segment or VLAN, or control them with firewall policies at layer 3 and above.
• Add accounting controls that track and log user activity and resource usage.

Caveats

The page gives no CVSS scores, no per-bug mechanism and no mapping of fixed builds to product lines. The HPE advisory is the place to check those.