Vulnerabilities · 5h ago
HPE released fixes for 72 vulnerabilities in Aruba Networking AOS-8 and AOS-10, including eight max-severity flaws, SecurityWeek reported. SecurityWeek counts 33 critical flaws; CSIRT Italia counts 32. HPE says it is not aware of exploitation in the wild.
Successful attacks could let unauthenticated attackers run code or commands, bypass authentication and gain administrative access, potentially compromising affected systems. The flaws affect AOS across mobility conductors, controllers, gateways, access points and compatible virtual machines (VMs).
If ArubaOS runs across those devices in your environment, the affected footprint spans the Wi-Fi estate, not just a central controller. The sources describe potential compromise of affected systems but do not establish a broader control-plane takeover.
CVEs in this update
8 CVEs
Across Simple Inventory System, ArubaOS (AOS).
7 critical · 1 high · 0 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-79844 · 10.0 CRITICAL
Highest EPSS: CVE-2026-79845 · 0.43%
2 sources covering this story
HPE Patches Dozens of Critical Flaws in Networking Products
Eight max-severity security defects could lead to remote code execution and authentication bypass.
HPE: rilevate vulnerabilità in ArubaOS
Rilasciati aggiornamenti di sicurezza che sanano molteplici vulnerabilità, di cui 32 con gravità “critica” e 31 con gravità “alta”, in HPE Aruba Networking AOS-8 e AOS-10, sistemi operativi di rete per la gestione delle infrastrutture Wi-Fi aziendali.
Part of the PlainSec briefing for 2026-10-27