HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical severity flaws.
The security updates fix eight maximum severity bugs: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850 and CVE-2026-79851.
Successful exploitation of these security vulnerabilities could allow unauthenticated attackers to perform remote code execution (RCE), bypass authentication to gain administrative privileges, execute arbitrary commands, and completely compromise affected systems.
HPE Networking AOS releases 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2 contain fixes for all eight bugs and have been deployed to Mobility Drivers, Controllers, Gateways, and Access Points products.
The remaining critical severity issues resolved with the updates could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access, and complete system compromise, HPE notes in its report. advisory.
HPE also resolved 31 high-severity vulnerabilities in its networking products, including more than a dozen that could be exploited without authentication, eight medium-severity flaws and one low-severity weakness.
The company notes that any “hardware, mobility solutions (such as drivers, controllers, and gateways), access points, or virtual machines (VMs)” compatible with vulnerable wireless operating systems are also affected by these security issues.
“To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web management interfaces be limited to a dedicated Layer 2 segment/VLAN and/or controlled by firewall policies at Layer 3 and above, as well as accounting controls for tracking and logging user activities and resource usage,” HPE notes.
The company says it is not aware of any of these vulnerabilities being exploited in the wild, but urges its customers to apply the patches as soon as possible.
Related: iOS, macOS 27.2, patch 286, bugs; Fix for an exploited flaw backported to iOS 18
Related: That’s Very Good: What NetScaler Zero-Days Tells Us About the New Normal
Related: Maritime Coalition launches free database of ship and port system vulnerabilities
Related: Node2Shell: Brotli flaw triggers patching of Microsoft, Node.js and Python packages
