Aruba wireless controllers and access points have eight 10.0 flaws. Plan the AOS upgrades this week

If your office Wi-Fi runs on Aruba gear, the controllers and access points behind it have a long upgrade list. HPE published fixes on October 22 for 72 vulnerabilities in its wireless operating systems, AOS-8 and AOS-10. Eight are rated 10.0 and need no login.

HPE says it has not seen public exploit code or attacks. It still told customers to patch “due to the complexity, breadth, and impact of these vulnerabilities,” and most of the bugs were found by its own researchers.

Eight of the 72 Aruba AOS fixes are rated 10.0 and need no login. The wireless controller is a box most companies forget to patch.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

HPE fixed 72 AOS bugs, eight of them rated 10.0

Advisory HPESBNW05162 covers Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 access points and AOS-8 Instant access points. The eight maximum-severity issues are CVE-2026-79844 through CVE-2026-79851: authentication bypasses, command injection, buffer overflows and SQL injection, each of which HPE says can lead to remote code execution.

Several others target PAPI, Aruba’s access point management protocol. CVE-2026-79857 and CVE-2026-79860 let an unauthenticated attacker run code by sending crafted packets to PAPI, which listens on UDP port 8211.

Aruba controllers, gateways and access points on AOS-8 and AOS-10

A wireless controller or gateway sees every client that joins the network and holds the configuration for every access point it manages. Code execution there means control of the traffic and a foothold inside the building’s network. BleepingComputer notes AOS runs mobility conductors, access points, controllers and gateways across Aruba’s enterprise wireless line.

HPE says versions past end of maintenance are presumed affected and not covered, so older controllers kept running because they still work are the ones at most risk. Canada’s Cyber Centre and France’s CERT-FR have both published alerts on the advisory.

Move to 8.13.3.1, 8.10.0.24, 10.8.1.2, 10.7.2.7 or 10.4.1.14

• List every Aruba Mobility Conductor, controller, gateway and Instant AP and note its AOS version.
• Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later, and AOS-8 to 8.13.3.1 or 8.10.0.24 or later, from the HPE Networking Support Portal.
• Until then, follow HPE’s workaround: put the CLI and web management interfaces on a dedicated VLAN or layer 2 segment, or behind firewall rules, with accounting turned on.
• Block UDP 8211 (PAPI) from any network segment that has no reason to reach the controllers.
• Plan the order with a simple rule: internet-reachable and guest-facing devices first. Our patch priority checklist walks through that ranking.

Details

• Advisory: HPESBNW05162, published October 22, 2026, revision 1. 72 CVEs from CVE-2026-79844 to CVE-2026-95721.
• Affected: AOS-10.8.x 10.8.1.1 and below; AOS-10.7.x 10.7.2.6 and below; AOS-10.4.x 10.4.1.13 and below; AOS-8.13.x 8.13.3.0 and below; AOS-8.10.x 8.10.0.23 and below.
• CVSS 10.0: CVE-2026-79844, 79845, 79847 and 79851 in AOS-10; CVE-2026-79846, 79848, 79849 and 79850 in AOS-8.
• Exploitation: none known to HPE as of release; not in CISA KEV as of catalog 2026.10.23.

Hunt / verify

• Check which management interfaces answer from user, guest or internet-facing networks. That exposure is what HPE’s workaround removes.
• Review controller and gateway accounting logs for admin logins or configuration changes nobody scheduled.
• After upgrading, confirm the running version on each device with show version and that managed APs picked up the new image.

Source: HPE advisory HPESBNW05162; CVE.org: CVE-2026-79844

Sources

• HPE Networking Product Security Advisory HPESBNW05162
• BleepingComputer: HPE patches eight max severity RCE and auth bypass AOS flaws
• Canadian Centre for Cyber Security: HPE security advisory (AV26-1079)
• CERT-FR: CERTFR-2026-AVI-1369
• CVE.org: CVE-2026-79844

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].