---
title: "HPE Aruba AOS-8/AOS-10: Eight CVSS 10 Unauth RCE Flaws"
url: https://erroneo.us/security/briefs/hpe-aruba-aos-8-aos-10-cvss-10-rce-flaws/
description: "HPE fixed 72 flaws in AOS-8 and AOS-10 controllers, gateways and APs, eight rated CVSS 10. Not known exploited; upgrade this week."
type: security-brief
section: "Security Digest"
date_published: 2026-10-22
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-79844", "CVE-2026-79845", "CVE-2026-79846", "CVE-2026-79847", "CVE-2026-79848", "CVE-2026-79849", "CVE-2026-79850", "CVE-2026-79851", "CVE-2026-79852", "CVE-2026-79860"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# HPE Aruba AOS-8/AOS-10: Eight CVSS 10 Unauth RCE Flaws

**Verdict: Patch this week.** Schedule AOS-8 and AOS-10 upgrades this week and wall off management interfaces and PAPI now; no attacks are known, but eight unauthenticated CVSS 10 bugs in enterprise Wi-Fi gear will not stay quiet for long.

- **Who must act:** Anyone running HPE Aruba Networking mobility conductors, controllers, gateways, AOS-10 access points or AOS-8 Instant APs, most urgently where management interfaces or UDP 8211 are reachable from user, guest or internet networks.
- **Who can relax:** Networks without Aruba AOS-8/AOS-10 wireless gear; AOS-CX switches and other HPE products are not covered by this bulletin.
- **Affected:** AOS-10.8.x.x: 10.8.1.1 and below; AOS-10.7.x.x: 10.7.2.6 and below; AOS-10.4.x.x: 10.4.1.13 and below; AOS-8.13.x.x: 8.13.3.0 and below; AOS-8.10.x.x: 8.10.0.23 and below; End-of-maintenance and end-of-support releases (presumed affected, no fix)
- **Fixed:** AOS-10.8.1.2; AOS-10.7.2.7; AOS-10.4.1.14; AOS-8.13.3.1; AOS-8.10.0.24
- **CVEs:** CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851, CVE-2026-79852, CVE-2026-79860
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Inventory every conductor, controller, gateway and AP running AOS-8 or AOS-10, including Instant APs and Central-managed gateways.
2. Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 (or later) from the HPE Networking Support Portal.
3. Move anything on an end-of-maintenance release to a supported train; HPE presumes those are affected and will not fix them.
4. Until upgraded, restrict the web UI and CLI to a dedicated management VLAN and firewall them from user, guest and internet networks.
5. Make sure UDP 8211 (PAPI) on controllers and gateways is reachable only from your own APs and controllers.

### How to check if you are affected

- Run show version on each controller, gateway and Instant AP (or check firmware in HPE Aruba Networking Central) and compare with the fixed releases.
- From user, guest and internet vantage points, check whether the web UI, SSH or UDP 8211 on controllers and gateways answers.
- Review controller audit logs for admin logins, new accounts and configuration changes you cannot explain; HPE has published no indicators of compromise.

## What happened

On October 22, 2026, HPE published [security bulletin HPESBNW05162](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US). It fixes 72 CVEs in the Wireless Operating Systems AOS-8 and AOS-10 that run Aruba mobility conductors, controllers, gateways and access points. Eight CVEs are rated CVSS 3.1 10.0, and many more are rated critical at 9.x. HPE's own researchers found most of the bugs, and a bug-bounty researcher ("moonv") reported others. The eight top-rated bugs are:

| CVE | OS | Bug |
|---|---|---|
| [CVE-2026-79844](https://www.cve.org/CVERecord?id=CVE-2026-79844) | AOS-10 | Authentication bypass leading to command execution |
| CVE-2026-79845 | AOS-10 | Authentication bypass in PAPI giving admin access |
| [CVE-2026-79846](https://www.cve.org/CVERecord?id=CVE-2026-79846) | AOS-8 | Unauthenticated command injection |
| CVE-2026-79847 | AOS-10 | Unauthenticated buffer overflow, code execution as a privileged user |
| CVE-2026-79848, CVE-2026-79849 | AOS-8 | Unauthenticated SQL injection leading to command execution |
| CVE-2026-79850 | AOS-8 | Authentication bypass leading to commands as root |
| CVE-2026-79851 | AOS-10 | Unauthenticated buffer overflow, code execution as a privileged user |

Just below those sit CVE-2026-79852 (9.8), an unauthenticated SQL injection in the web management interface, and CVE-2026-79860 (9.8), buffer overflows reachable with crafted packets to PAPI, Aruba's access point management protocol, on UDP port 8211.

## Who is affected

The bulletin covers mobility conductors, mobility controllers, Central-managed mobility gateways, AOS-10 access points and AOS-8 Instant APs. HPE says any hardware or VM that runs an affected release is vulnerable, even if its model is not listed.

- AOS-10.8 up to 10.8.1.1, 10.7 up to 10.7.2.6 and 10.4 up to 10.4.1.13
- AOS-8.13 up to 8.13.3.0 and 8.10 up to 8.10.0.23
- Releases past end of maintenance are presumed affected and get no fix. HPE has not assessed releases past end of support.

## Do you really need to act?

**Yes, this week. Today if a management interface faces untrusted networks.** HPE says it is "not aware of any public discussion or exploit code," and [BleepingComputer](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/) found no public proof of concept or in-the-wild use. None of the CVEs is in CISA KEV. Even so, HPE "strongly urged" customers to patch, citing "the complexity, breadth, and impact" of the bugs.

Real exposure depends on what can reach the "affected interface." For most of the critical bugs HPE does not say which interface that is. The ones it names are the web management UI, the CLI, and PAPI on UDP 8211. A second group, rated up to 9.6, needs an attacker on the same network segment ("adjacent"). On a wireless network, that can mean any client that has joined it. Each CVSS 10 vector is network-reachable with no credentials and no user interaction. For some of them, HPE adds that "certain preconditions outside of the attacker's control" must hold, without saying which.

Sites where the controller's management interfaces are reachable only from a locked-down management VLAN are in much better shape than sites where guest or employee Wi-Fi can reach them. Patch either way. A wireless controller holds RADIUS secrets and certificates and sits on the path of every client, which makes it a valuable foothold.

## What to do now

1. Inventory every AOS-8 and AOS-10 device. Run `show version` on each conductor, controller, gateway and Instant AP, or read firmware versions in HPE Aruba Networking Central.
2. Upgrade to **10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24** or later, downloaded from the HPE Networking Support Portal. Plan AP and controller upgrades together where your design requires matching versions.
3. Move devices on end-of-maintenance releases to a supported train. They will not get a fix.
4. Until you upgrade, apply HPE's workaround. Restrict the CLI and web UI to a dedicated layer 2 segment or VLAN, and firewall them at layer 3 and above. Log administrative activity.
5. Check that UDP 8211 on controllers and gateways is reachable only from your own APs and controllers, never from client, guest or internet networks.

## How to tell if you were hit

HPE has published no indicators of compromise, and no attacks are known. Check exposure first: from a guest SSID, a user VLAN and the internet, test whether the controller's web UI, SSH or UDP 8211 responds. Then review controller audit logs for administrative logins from unexpected sources, new local accounts, and configuration changes nobody made. If a device was exposed to untrusted networks and you find unexplained changes, rebuild it from known-good firmware and configuration. Then rotate the RADIUS shared secrets, PSKs and certificates it held.

## Timeline

- Oct 22, 2026 — HPE publishes HPESBNW05162 rev.1 with fixes for 72 CVEs. CVE records are published the same day.
- Oct 23, 2026 — Press coverage begins. No public exploit or in-the-wild exploitation is reported, and the CVEs are not in CISA KEV.

## Sources

1. [HPE — HPESBNW05162 rev.1: Multiple vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US)
2. [CVE record — CVE-2026-79844](https://www.cve.org/CVERecord?id=CVE-2026-79844)
3. [CVE record — CVE-2026-79846](https://www.cve.org/CVERecord?id=CVE-2026-79846)
4. [BleepingComputer — HPE patches eight max severity RCE and auth bypass AOS flaws](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/)

---
Source page: https://erroneo.us/security/briefs/hpe-aruba-aos-8-aos-10-cvss-10-rce-flaws/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt