HPE has released one of the biggest wireless security updates in recent memory, patching 72 vulnerabilities in ArubaOS (AOS-8 and AOS-10), the operating system behind Aruba Mobility Conductors, Mobility Controllers, Central-managed Gateways and access points. Eight of the flaws carry the maximum CVSS score of 10.0 and allow unauthenticated remote code execution, authentication bypass, command injection and SQL injection through low-complexity attacks that need no user interaction. Security bulletin HPESBNW05162 landed on October 22, 2026, and HPE warns that customers “are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.” Here’s what is affected, which firmware you need, and how to protect controllers you cannot upgrade tonight.
The Bulletin: Eight Perfect-10 Flaws
BleepingComputer and SecurityWeek both list the same eight maximum-severity bugs, split across the two platforms:
- CVE-2026-79844: Authentication bypass leading to RCE in AOS-10
- CVE-2026-79845: Authentication bypass in the PAPI protocol of AOS-10
- CVE-2026-79846: Unauthenticated command injection in AOS-8
- CVE-2026-79847 and CVE-2026-79851: Unauthenticated buffer overflows leading to RCE in AOS-10
- CVE-2026-79848 and CVE-2026-79849: Unauthenticated SQL injection leading to RCE in AOS-8
- CVE-2026-79850: Authentication bypass leading to RCE in AOS-8
SecurityWeek notes that successful exploitation could let attackers gain administrative privileges, run arbitrary commands and “completely compromise the affected systems.” HPE also says every piece of hardware, controller, gateway, access point or VM compatible with the vulnerable operating systems is in scope. The good news is that HPE is “not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory.”
The PAPI Problem
A big share of this bulletin centers on PAPI, Aruba’s long-standing control protocol that access points and controllers use to talk to each other over UDP port 8211. In its analysis of the bulletin, Safeguard counted 22 of the 72 CVEs involving PAPI and found that 58 of the 72 require no credentials at all. That is a problem for any deployment where remote APs or branch gateways reach controllers across the internet, or where Instant AP clusters sit on flat networks.
Enabling Control Plane Security (CPsec), which wraps AP-to-controller PAPI traffic in an IPsec tunnel, narrows who can talk to a controller, but it does not fix the underlying bugs. Only the fixed firmware does that.
The Firmware You Need
HPE’s fixes are available across five release trains. If your gear runs below these versions, it is vulnerable:
- AOS-10.8: 10.8.1.2 and above
- AOS-10.7: 10.7.2.7 and above
- AOS-10.4: 10.4.1.14 and above
- AOS-8.13: 8.13.3.1 and above
- AOS-8.10: 8.10.0.24 and above
Watch out for trains that are not on that list. HPE says software past End of Maintenance is presumed affected and will not get a fix, and Safeguard’s review of the machine-readable advisory found that AOS-8.12, 10.6 and 10.3 fall inside the affected ranges with no fixed build of their own. For those devices, the remedy is a train change, not a quick patch. Separately, France’s CERT-FR flagged a companion HPE bulletin for ClearPass Policy Manager, with fixes in 6.11.16 and 6.14.1.
What IT Pros Should Do Now
HPE recommends that “the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage.” Put that into practice with a short checklist:
- Build the inventory: Export AOS-10 devices and firmware versions from HPE Networking Central, and pull version info from every AOS-8 conductor, controller and Instant AP virtual controller.
- Lock down management: Make sure SSH, web management and APIs are reachable only from a dedicated management network.
- Restrict PAPI: Permit UDP 8211 to controllers only from known AP subnets and peer controllers, and keep CPsec enabled on AOS-8 deployments.
- Turn on accounting: Send command accounting and logs to central syslog or TACACS+ so admin activity is recorded off the device.
- Schedule upgrades: Start with internet-facing gateways and remote AP concentrators, then work inward. AOS-10 upgrades in Central still need to be scheduled per group.
- Plan the refresh: Flag end-of-maintenance gear and get the train change or hardware replacement on the calendar.
Looking Ahead
No exploitation has been reported yet, but a 72-CVE bulletin with eight perfect scores is an open invitation for researchers and attackers to start diffing firmware. Network edge gear has been a top target all year, and wireless controllers often sit in the same trusted management zones as firewalls and core switches.
For teams running Aruba wireless, the next few maintenance windows should go to this upgrade. The organizations that already keep management planes isolated and PAPI locked to known peers are starting from a much safer place, and everyone else just got a strong reason to get there.
Sources:
- HPE Networking Security Bulletin HPESBNW05162, October 22, 2026
- BleepingComputer, October 23, 2026
- CERT-FR, October 23, 2026
- Safeguard, October 23, 2026
- SecurityWeek, October 27, 2026
