CriticalMalwareCVE-2026-79850
HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices
Cyber Security News·Source published ·1 min read
What happened?
Hewlett Packard Enterprise has released security patches for multiple vulnerabilities in Aruba Networking wireless software that could let attackers take complete control of affected devices. The flaws affect AOS-8 and AOS-10 deployments across Mobility Conductors, Controllers, Gateways, and access points. Several allow attacks without a valid login, making prompt patching a priority for network administrators. HPE Warns Aruba Networking Flaws HPE’s October 22 security bulletin, HPESBNW05162, describes authentication bypass, command injection, SQL injection, and buffer overflow flaws.
Key details
- HPE released patches for multiple critical Aruba Networking vulnerabilities.
- Flaws affect AOS-8 and AOS-10 across Mobility Conductors, Controllers, Gateways, and access points.
- Several vulnerabilities allow authentication bypass without a valid login.
- Eight CVEs have maximum CVSS severity score of 10.0.
- CVE-2026-79850 lets attacker bypass AOS-8 authentication and execute commands as root.
- CVE-2026-79855 affects AOS-8 SSH service granting unauthenticated admin access.
- AOS-10 PAPI flaw CVE-2026-79845 bypasses login checks and changes configurations.
Affected
- AOS-10.8.1.1 and earlier, AOS-10.7.2.6 and earlier, AOS-10.4.1.13 and earlier.
- AOS-8.13.3.0 and earlier, AOS-8.10.0.23 and earlier.
- Compatible hardware and virtual deployments are in scope.
Fixes and mitigations
- Upgrade to AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, or AOS-8.10.0.24.
- Updates available through HPE Networking Support Portal.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.