HPE ArubaOS AOS-8/AOS-10 Hit by Eight CVSS 10.0 Flaws - Patch Immediately

Overview/Introduction

On 22 October 2026 Hewlett Packard Enterprise (HPE) published security bulletin HPESBNW05162, announcing the remediation of 72 vulnerabilities in its Aruba Networking wireless operating systems - AOS-8 and AOS-10. Among them, eight CVEs (CVE-2026-79844 through CVE-2026-79851) received the maximum CVSS 3.1 score of 10.0. These flaws span authentication bypass, unauthenticated command injection, buffer overflows, and SQL injection, all of which can culminate in remote code execution (RCE) on widely deployed enterprise Wi-Fi infrastructure.

While HPE reports no known public exploits or active exploitation in the wild, the sheer technical severity, low attack complexity, and network-reachable nature of the bugs make them a high-priority remediation case for any organization that runs Aruba Mobility Controllers, Mobility Conductors, Gateways, or Access Points.

Technical Details

The eight top-severity CVEs share a common CVSS vector:

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English, an attacker can trigger the vulnerability over the network, with no prior access, low complexity, and without any user interaction. The exploit changes the scope of the attack, granting full confidentiality, integrity, and availability impact.

CVE-2026-79844 - Authentication Bypass → RCE (AOS-10)

• Vector: Crafted HTTP request to the web-based management interface.
• Root cause: Improper validation of authentication tokens in the login flow, allowing an attacker to bypass credential checks.
• Impact: Once bypassed, the attacker can execute arbitrary CLI commands, ultimately achieving system-level code execution.
• Pre-conditions: Requires the management interface to be reachable from the attacker’s network; no privileged credentials needed.

CVE-2026-79845 - Authentication Bypass in PAPI Protocol (AOS-10)

• Exploits a flaw in the Proprietary API (PAPI) used for controller-to-controller communication.
• Malformed PAPI packets can skip authentication checks, granting full control of the device.

CVE-2026-79846 - Unauthenticated Command Injection (AOS-8)

• Triggers a command-injection bug in the REST API endpoint /api/v1/system/diagnostics.
• Specially crafted JSON payload injects shell commands that run with root privileges.

CVE-2026-79847 - Unauthenticated Buffer Overflow → RCE (AOS-10)

• Overflow occurs in the handling of the device_name field of the SNMP configuration API.
• Overflow overwrites adjacent memory, enabling arbitrary code execution.

CVE-2026-79848 & CVE-2026-79849 - Unauthenticated SQL Injection → RCE (AOS-8)

• Both vulnerabilities target the internal SQLite database used for storing user-defined policies.
• SQL payloads can be injected via the policy_name parameter of the web UI, leading to execution of OS commands via SQLite’s load_extension function.

CVE-2026-79850 - Authentication Bypass → RCE (AOS-8)

• Similar to CVE-2026-79844, but affects the legacy CLI over SSH. Manipulating the SSH banner response can skip the authentication handshake.

CVE-2026-79851 - Unauthenticated Buffer Overflow → RCE (AOS-10)

• Exploits a heap overflow in the DHCP relay service when processing malformed DHCP options.
• Allows an attacker on the same broadcast domain to execute arbitrary code on the controller.

Impact Analysis

The affected product line forms the backbone of most enterprise and campus Wi-Fi deployments:

• Aruba Mobility Controllers (AOS-8, AOS-10)
• Mobility Conductors (clustered controllers)
• Mobility Gateways (branch-office WAN aggregation)
• Aruba Access Points running the embedded AOS stack

Compromise of any of these devices provides an attacker with:

• Full control over wireless traffic - sniffing, injection, and rogue AP creation.
• Persistence inside the network core, bypassing perimeter firewalls.
• Potential lateral movement to VLAN-segmented assets via compromised DHCP or DNS services.
• Denial-of-service capabilities by disabling radios or corrupting configuration.

Given the prevalence of Aruba equipment in Fortune-500 enterprises, universities, and government campuses, the attack surface is extensive. Even though no public exploit exists, threat actors often weaponize zero-day RCEs quickly once patches are released.

Timeline of Events

• 22 Oct 2026 - HPE issues bulletin HPESBNW05162, announces patches for 72 vulnerabilities, highlights eight CVSS 10.0 flaws.
• 23 Oct 2026 - Security outlets (Rescana, BleepingComputer) publish detailed analyses; HPE confirms no known exploitation.
• 24 Oct 2026 onward - Vendors and MSSPs begin distribution of patched firmware: AOS-10.8.1.2, 10.7.2.7, 10.4.1.14; AOS-8.13.3.1, 8.10.0.24, or later.
• Future - Potential inclusion in CISA’s KEV list if active exploitation is observed.

Mitigation/Recommendations

HPE’s advisory recommends two layers of defense while patching is in progress:

1. Network segmentation: Isolate the management interfaces (CLI, Web UI, API) on a dedicated VLAN or a physically separate management network. Apply strict ACLs that only allow trusted administrative hosts.
2. Firewall filtering: Block inbound traffic to ports 22 (SSH), 443 (HTTPS), and 8443 (Web UI) from any untrusted subnet. If remote management is required, use a jump host with multi-factor authentication.
3. Patch promptly: Upgrade to the fixed versions - AOS-10.8.1.2, 10.7.2.7, 10.4.1.14 for AOS-10, and AOS-8.13.3.1, 8.10.0.24 for AOS-8. Verify the firmware signature before installation.
4. Audit and harden: Disable unused services (PAPI, SNMP, DHCP relay) if they are not required. Enforce strong administrative passwords and enable local account lockout.
5. Logging & monitoring: Enable syslog forwarding to a SIEM, watch for anomalous login attempts, unexpected CLI commands, or unexplained device reboots.
6. Incident response prep: Have a rollback plan in case the new firmware introduces regressions. Capture configuration backups before upgrading.

Real-World Impact

In practice, an attacker who successfully exploits any of the eight CVEs could:

• Harvest credentials from wireless clients by injecting malicious WPA2-Enterprise RADIUS packets.
• Redirect traffic to a malicious proxy, facilitating data exfiltration or credential harvesting.
• Deploy a rogue “evil twin” AP that mirrors the legitimate SSID, leading to man-in-the-middle attacks on thousands of devices.
• Disable Wi-Fi services during a critical business window (e.g., a conference or exam period), creating a denial-of-service incident.

Organizations that rely on Aruba for guest Wi-Fi, IoT device onboarding, or campus-wide connectivity could see immediate operational disruption, compliance violations (e.g., PCI-DSS for guest networks), and reputational damage.

Expert Opinion

From a strategic standpoint, the disclosure underscores a growing trend: wireless infrastructure is no longer a peripheral component but a core part of the network fabric. The fact that eight separate flaws each achieve unauthenticated RCE at CVSS 10.0 is alarming, even if they are not yet weaponized in the wild.

Enterprises should treat ArubaOS with the same rigor they apply to traditional data-plane operating systems. The “low attack complexity” and “no-user-interaction” attributes mean that a skilled attacker can automate exploitation across any exposed controller. Moreover, the “changed scope” metric indicates that the compromise can jump from the management plane to the data plane, effectively giving the adversary control over all attached radios.

In the short term, rapid patching is non-negotiable. In the longer term, organizations must adopt a zero-trust approach to network-infrastructure management: enforce strict segmentation, rotate management credentials regularly, and integrate continuous vulnerability scanning of firmware images into their CI/CD pipeline.

Finally, the absence of public PoC code does not equate to safety. History shows that once patches are released, exploit authors scramble to develop proof-of-concepts. The window between disclosure and widespread exploitation can be measured in days. Proactive remediation, combined with robust monitoring, is the only viable defense.