erroneo.us
Search all guides⌘K

Security Digest · Oct 22, 2026 · Vulnerability · Network edge

HPE Aruba AOS-8/AOS-10: Eight CVSS 10 Unauth RCE Flaws

HPE fixed 72 flaws in AOS-8 and AOS-10 controllers, gateways and APs, eight rated CVSS 10. Not known exploited; upgrade this week.

Published By erroneo.us Security Desk · Updated 3 min read4 sources

Our verdict

Patch this week

Schedule AOS-8 and AOS-10 upgrades this week and wall off management interfaces and PAPI now; no attacks are known, but eight unauthenticated CVSS 10 bugs in enterprise Wi-Fi gear will not stay quiet for long.

Who must act: Anyone running HPE Aruba Networking mobility conductors, controllers, gateways, AOS-10 access points or AOS-8 Instant APs, most urgently where management interfaces or UDP 8211 are reachable from user, guest or internet networks.

Who can relax: Networks without Aruba AOS-8/AOS-10 wireless gear; AOS-CX switches and other HPE products are not covered by this bulletin.

Affected
AOS-10.8.x.x: 10.8.1.1 and below
AOS-10.7.x.x: 10.7.2.6 and below
AOS-10.4.x.x: 10.4.1.13 and below
AOS-8.13.x.x: 8.13.3.0 and below
AOS-8.10.x.x: 8.10.0.23 and below
End-of-maintenance and end-of-support releases (presumed affected, no fix)
Fixed in
AOS-10.8.1.2
AOS-10.7.2.7
AOS-10.4.1.14
AOS-8.13.3.1
AOS-8.10.0.24
CVSS
10.0 (v3.1, vendor)
EPSS
0.5% (percentile 45)
CISA KEV
Not listed
Exploitation
No known exploitation
Severity
Critical

What to do

  1. Inventory every conductor, controller, gateway and AP running AOS-8 or AOS-10, including Instant APs and Central-managed gateways.
  2. Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 (or later) from the HPE Networking Support Portal.
  3. Move anything on an end-of-maintenance release to a supported train; HPE presumes those are affected and will not fix them.
  4. Until upgraded, restrict the web UI and CLI to a dedicated management VLAN and firewall them from user, guest and internet networks.
  5. Make sure UDP 8211 (PAPI) on controllers and gateways is reachable only from your own APs and controllers.

How to check if you are affected or compromised

  • Run show version on each controller, gateway and Instant AP (or check firmware in HPE Aruba Networking Central) and compare with the fixed releases.
  • From user, guest and internet vantage points, check whether the web UI, SSH or UDP 8211 on controllers and gateways answers.
  • Review controller audit logs for admin logins, new accounts and configuration changes you cannot explain; HPE has published no indicators of compromise.

What happened#

On October 22, 2026, HPE published security bulletin HPESBNW05162. It fixes 72 CVEs in the Wireless Operating Systems AOS-8 and AOS-10 that run Aruba mobility conductors, controllers, gateways and access points. Eight CVEs are rated CVSS 3.1 10.0, and many more are rated critical at 9.x. HPE's own researchers found most of the bugs, and a bug-bounty researcher ("moonv") reported others. The eight top-rated bugs are:

CVEOSBug
CVE-2026-79844AOS-10Authentication bypass leading to command execution
CVE-2026-79845AOS-10Authentication bypass in PAPI giving admin access
CVE-2026-79846AOS-8Unauthenticated command injection
CVE-2026-79847AOS-10Unauthenticated buffer overflow, code execution as a privileged user
CVE-2026-79848, CVE-2026-79849AOS-8Unauthenticated SQL injection leading to command execution
CVE-2026-79850AOS-8Authentication bypass leading to commands as root
CVE-2026-79851AOS-10Unauthenticated buffer overflow, code execution as a privileged user

Just below those sit CVE-2026-79852 (9.8), an unauthenticated SQL injection in the web management interface, and CVE-2026-79860 (9.8), buffer overflows reachable with crafted packets to PAPI, Aruba's access point management protocol, on UDP port 8211.

Who is affected#

The bulletin covers mobility conductors, mobility controllers, Central-managed mobility gateways, AOS-10 access points and AOS-8 Instant APs. HPE says any hardware or VM that runs an affected release is vulnerable, even if its model is not listed.

  • AOS-10.8 up to 10.8.1.1, 10.7 up to 10.7.2.6 and 10.4 up to 10.4.1.13
  • AOS-8.13 up to 8.13.3.0 and 8.10 up to 8.10.0.23
  • Releases past end of maintenance are presumed affected and get no fix. HPE has not assessed releases past end of support.

Do you really need to act?#

Yes, this week. Today if a management interface faces untrusted networks. HPE says it is "not aware of any public discussion or exploit code," and BleepingComputer found no public proof of concept or in-the-wild use. None of the CVEs is in CISA KEV. Even so, HPE "strongly urged" customers to patch, citing "the complexity, breadth, and impact" of the bugs.

Real exposure depends on what can reach the "affected interface." For most of the critical bugs HPE does not say which interface that is. The ones it names are the web management UI, the CLI, and PAPI on UDP 8211. A second group, rated up to 9.6, needs an attacker on the same network segment ("adjacent"). On a wireless network, that can mean any client that has joined it. Each CVSS 10 vector is network-reachable with no credentials and no user interaction. For some of them, HPE adds that "certain preconditions outside of the attacker's control" must hold, without saying which.

Sites where the controller's management interfaces are reachable only from a locked-down management VLAN are in much better shape than sites where guest or employee Wi-Fi can reach them. Patch either way. A wireless controller holds RADIUS secrets and certificates and sits on the path of every client, which makes it a valuable foothold.

What to do now#

  1. Inventory every AOS-8 and AOS-10 device. Run show version on each conductor, controller, gateway and Instant AP, or read firmware versions in HPE Aruba Networking Central.
  2. Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 or later, downloaded from the HPE Networking Support Portal. Plan AP and controller upgrades together where your design requires matching versions.
  3. Move devices on end-of-maintenance releases to a supported train. They will not get a fix.
  4. Until you upgrade, apply HPE's workaround. Restrict the CLI and web UI to a dedicated layer 2 segment or VLAN, and firewall them at layer 3 and above. Log administrative activity.
  5. Check that UDP 8211 on controllers and gateways is reachable only from your own APs and controllers, never from client, guest or internet networks.

How to tell if you were hit#

HPE has published no indicators of compromise, and no attacks are known. Check exposure first: from a guest SSID, a user VLAN and the internet, test whether the controller's web UI, SSH or UDP 8211 responds. Then review controller audit logs for administrative logins from unexpected sources, new local accounts, and configuration changes nobody made. If a device was exposed to untrusted networks and you find unexplained changes, rebuild it from known-good firmware and configuration. Then rotate the RADIUS shared secrets, PSKs and certificates it held.

Timeline#

  • — HPE publishes HPESBNW05162 rev.1 with fixes for 72 CVEs. CVE records are published the same day.
  • — Press coverage begins. No public exploit or in-the-wild exploitation is reported, and the CVEs are not in CISA KEV.

Vulnerability records

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. HPE — HPESBNW05162 rev.1: Multiple vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8) support.hpe.com
  2. CVE record — CVE-2026-79844 cve.org
  3. CVE record — CVE-2026-79846 cve.org

Coverage and analysis

  1. BleepingComputer — HPE patches eight max severity RCE and auth bypass AOS flaws bleepingcomputer.com