HPE patches eight max severity RCE and auth bypass AOS flaws

HPE released security updates on 22 October 2026 patching 72 vulnerabilities in ArubaOS, the software that runs Aruba wireless and wired network devices. The update covers two branches, AOS-8 and AOS-10. Eight of the flaws carry the maximum CVSS score of 10.0 and combine authentication bypass with remote code execution, meaning remote attackers with no login and no user interaction could bypass authentication or run commands on affected devices. HPE has no knowledge of public discussion, exploit code, or in-the-wild exploitation targeting these flaws as of the advisory release date. HPE Networking published advisory HPESBNW05162 on 22 October 2026.

The eight maximum-severity flaws are tracked as CVE-2026-79844 through CVE-2026-79851. HPE says two of them also depend on conditions outside the attacker’s control. Because CVE-2026-79848 and CVE-2026-79849 share one HPE bulletin entry, seven entries cover the eight IDs. The flaws let remote attackers with no login and no user interaction bypass authentication or run commands on affected devices.

Several of the eight flaws have distinct attack paths. CVE-2026-79850 lets remote attackers bypass authentication and execute arbitrary commands as root. CVE-2026-79847 and CVE-2026-79851 involve unauthenticated buffer overflows leading to privileged remote code execution.

CVE-2026-79848 and CVE-2026-79849 permit unauthenticated SQL injection that leads to operating system command execution. CVE-2026-79846 allows unauthenticated command injection if specific preconditions outside the attacker’s control hold true. CVE-2026-79844 enables authentication bypass leading to command execution under specified preconditions in AOS-10, and CVE-2026-79845 allows administrative access via PAPI authentication weaknesses in AOS-10. HPE links CVE-2026-79845 to a PAPI flaw.

Affected versions include AOS-10.8.1.1 and below, 10.7.2.6 and below, 10.4.1.13 and below, AOS-8.13.3.0 and below, and AOS-8.10.0.23 and below. HPE says compatible hardware running an affected version is vulnerable. Fixed releases are AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1, and 8.10.0.24. The fixed software is available on the HPE Networking Support Portal. There is a discrepancy in one CVE assignment: VulDB’s record dated 25 August 2026 assigns CVE-2026-79845 to a SQL injection flaw in code-projects Simple Inventory System 1.0 instead of the PAPI issue HPE describes.

HPE recommends isolating management interfaces on a dedicated layer 2 segment or VLAN, using layer 3 and above firewall policies, and enabling accounting controls. The vendor presumes software past End of Maintenance is affected and excludes it from the bulletin, and has not assessed versions past End of Support, urging customers to move to a supported release.

Brandefense checked for public exploit code, attack reports, and GitHub repositories for the eight CVEs rated 10.0 on Oct. 23 and found none. None of the vulnerabilities appears in the CISA Known Exploited Vulnerabilities catalog.

HPE labels 33 of the 72 flaws Critical, 31 High, 7 Medium, and 1 Low, while Daily Security Review reports 34 of the 72 flaws are critical. HPE’s severity breakdown leaves only one of the 72 flaws rated Low. CVSS data shows 58 of the 72 flaws require no login. Of the 72 flaws, 32 are reachable over the network and 25 require adjacent network access.

Most severe flaws in the advisory permit arbitrary code execution by a privileged user. Two flaws can crash a device, blocking reboot without manual help. The PAPI protocol handling, which controls access points over UDP port 8211, includes command injection and buffer overflow issues. Most vulnerabilities were found through HPE internal research. Bugcrowd researchers moonv, LIUPENG, and zzcentury are credited alongside Diego Gomez, David Kierznowski, and a Siemens Energy team.

HPE has a history of addressing similar flaws. In June 2025, the company patched eight critical StoreOnce vulnerabilities involving authentication bypass and remote code execution. One month later, HPE warned about hardcoded credentials in Aruba Instant On devices that allow authentication bypass. In January 2025, CISA flagged a severe HPE OneView vulnerability under active attack. HPE recently warned that critical flaws on unpatched AOS-CX devices allow admin password resets and remote code execution.