Hewlett Packard Enterprise has pushed out patches addressing a cluster of severe vulnerabilities in its Aruba wireless products. The issues span versions AOS-8 and AOS-10 and impact Mobility Conductors, Controllers, Gateways, and Access Points. Some of these flaws allow attackers to execute commands or gain administrative access without any valid login credentials.
What’s at Stake
Eight separate Common Vulnerabilities and Exposures (CVEs) hit the maximum severity score—10.0. If exploited, these weaknesses could expose sensitive data, alter critical device settings, or allow execution of high-privilege commands.
Notably, CVE-2026-79850 lets attackers bypass authentication in AOS-8 and execute root-level commands, while CVE-2026-79855 similarly grants unauthenticated admin access to SSH on AOS-8 systems. On the AOS-10 side, CVE-2026-79845 affects the PAPI protocol used for managing access points, allowing attackers to skip login checks and manipulate configurations. Additional issues like CVE-2026-79847 and CVE-2026-79851 are buffer overflows that could facilitate remote code execution. A further flaw, CVE-2026-79860, involves malformed packets sent to UDP port 8211 on AOS-8 systems.
Affected Systems & Recommended Fixes
The vulnerabilities affect several software branches and device types. For AOS-10, affected versions include 10.8.1.1, 10.7.2.6, and 10.4.1.13 (and earlier versions in those branches). For AOS-8, the vulnerable builds include 8.13.3.0 and 8.10.0.23, along with older releases. Hardware and virtual deployments are both at risk.
To address the issues, HPE advises upgrading to patched builds: AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, or 8.10.0.24. Until those updates are applied, administrators should limit management interfaces (CLI and web) to dedicated network segments or VLANs protected by firewalls, and implement logging and monitoring to track user activity. These interim steps can reduce risk, but don’t replace applying the fixes.
Exploit Status & Long-Term Guidance
HPE reports no evidence so far of public exploits or discussions of active attacks exploiting these flaws. However, absence of evidence is not evidence of absence. Users of unsupported or out-of‐maintenance software should not assume immunity and should prioritize moving to supported versions.
What this means: These types of vulnerabilities—authentication bypass, SQL and command injection, buffer overflow—have been the source of past network breaches. Aruba’s gear is widely used in enterprise environments, so any delay in patching could expose thousands of devices to takeover risks.
