Hewlett Packard Enterprise has fixed 72 vulnerabilities in ArubaOS, the software that runs its Aruba wireless controllers, access points and gateways, including eight rated maximum severity that let attackers take over devices without logging in, BleepingComputer reported Friday. None is known to be exploited, giving organizations that rely on Aruba networks a short window to patch before attackers study the fixes.
What Happened
According to BleepingComputer, HPE published the advisory Thursday. The eight most serious flaws affect several versions of both the AOS-8 and AOS-10 lines and can be exploited remotely with little effort, no privileges and no user interaction.
In AOS-10, CVE-2026-79844 is an authentication bypass that leads to remote code execution, meaning an attacker can run commands of their choosing on the device. CVE-2026-79845 bypasses authentication in Aruba's PAPI protocol. CVE-2026-79847 and CVE-2026-79851 are buffer overflows, in which oversized input spills into memory the software did not reserve for it, that can be triggered without credentials to run code.
In AOS-8, CVE-2026-79846 is an unauthenticated command injection flaw. CVE-2026-79848 and CVE-2026-79849 are SQL injection bugs, which slip database commands into unchecked input, that lead to code execution. CVE-2026-79850 is another authentication bypass leading to code execution.
HPE told customers they "are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," according to BleepingComputer, which did not list the affected version numbers.
Why It Matters
Aruba controllers, access points and gateways sit at the heart of many corporate wireless networks. A device that can be taken over without a password gives an intruder a foothold inside the network and a place to watch or redirect traffic.
The absence of known attacks is the useful part. BleepingComputer reported that HPE knew of no public proof-of-concept code, the sample exploits researchers and criminals often publish, and no public discussion of the flaws when it released the advisory. Once fixes are out, attackers can compare patched and unpatched software to find the bugs, so that advantage shrinks with time.
Executives should ask their network teams which Aruba devices run AOS-8 or AOS-10, whether their management interfaces are reachable from the internet or ordinary user networks, and when upgrades are scheduled.
Context
This is not HPE's only recent networking fix. BleepingComputer noted that HPE has also warned of flaws in AOS-CX, a separate Aruba operating system, that allow administrator password resets and remote code execution.
Until devices are updated, HPE advises limiting access to the command-line and web management interfaces to a dedicated network segment or virtual LAN, or filtering it with firewall policies, and turning on accounting logs that record user activity.
What to Watch
The signals to track are the publication of proof-of-concept code, reports of exploitation, and whether CISA, the U.S. Cybersecurity and Infrastructure Security Agency, adds any of the eight flaws to its catalog of exploited vulnerabilities, which would set federal patch deadlines.
