8 CVSS 10.0 Flaws in HPE Aruba AOS: 72 Vulnerabilities Patched — Act Before Exploits Drop

Your enterprise Wi-Fi and network infrastructure just became an emergency patching priority. On 22 October 2026, HPE quietly dropped a security bulletin that should have every network engineer reaching for their maintenance window: 72 vulnerabilities patched in HPE Aruba Networking’s AOS-8 and AOS-10, the wireless operating systems powering Mobility Conductors, Controllers, Gateways, and access points worldwide — eight of them scored the maximum CVSS 10.0. No authentication required. No user interaction needed. An attacker anywhere on the internet, given the right network path, can execute arbitrary commands on your infrastructure and walk away with full control.

India’s enterprise sector has expanded Wi-Fi and SD-Access deployments dramatically, and HPE Aruba is one of the dominant platforms in campus, healthcare, government, and BFSI networks. If you operate Aruba AOS-8 or AOS-10 — and tens of thousands of Indian organizations do — read this before the week is out.

The Bulletin: 72 Vulnerabilities, Eight Scored Perfect 10

HPE’s HPESBNW05162 advisory covers both ArubaOS generations simultaneously. AOS-10 is the cloud-native architecture running HPE Aruba Networking Central-managed gateways and access points; AOS-8 is the legacy-but-widely-deployed controller-based stack. Both are vulnerable. Both received fixes in the same drop.

The severity distribution is stark: of 72 CVEs, eight are rated CVSS 3.1 base score 10.0 — the highest possible score, indicating attacks require no privileges, no user interaction, and are network-reachable. Many of the remaining 64 flaws are rated High (7.x–9.x). This is not a routine quarterly patch cycle; this is a mass-severity event.

The eight CVSS 10.0 CVEs are:

CVE	CVSS	Platform	Vulnerability Type
CVE-2026-79844	10.0	AOS-10	Authentication bypass via PAPI → RCE
CVE-2026-79845	10.0	AOS-10	Authentication bypass via PAPI → RCE
CVE-2026-79846	10.0	AOS-8	Unauthenticated command injection
CVE-2026-79847	10.0	AOS-10	Unauthenticated buffer overflow → RCE
CVE-2026-79848	10.0	AOS-8	Unauthenticated SQL injection → RCE
CVE-2026-79849	10.0	AOS-8	Unauthenticated SQL injection → RCE
CVE-2026-79850	10.0	AOS-8	Authentication bypass → RCE
CVE-2026-79851	10.0	AOS-10	Unauthenticated buffer overflow → RCE

Technical Breakdown: How Attackers Would Exploit These

The vulnerability classes here are well-understood — and that is exactly what makes them so dangerous in a public advisory without an embargo. Each attack path represents a foundational security failure:

Authentication Bypass (CVE-2026-79844, CVE-2026-79845, CVE-2026-79850): These flaws target PAPI — the Aruba Process Application Programming Interface — the internal management protocol used between ArubaOS components. An attacker who can reach the PAPI port (UDP 8211) can send crafted packets that the system accepts without any valid credentials, then chain into OS-level command execution. PAPI-based exploits have been weaponized before; BleepingComputer’s analysis of the bulletin confirms the same interface is in scope here.

Unauthenticated Command Injection (CVE-2026-79846): On AOS-8, this flaw allows a network-accessible, unauthenticated attacker to pass shell metacharacters into an underlying service, causing arbitrary commands to run as a privileged process. This is a textbook operating system takeover — if your AOS-8 management interface is reachable from a corporate LAN without proper segmentation, any employee or compromised endpoint becomes a potential threat actor.

SQL Injection to RCE (CVE-2026-79848, CVE-2026-79849): Two separate SQL injection paths exist in the AOS-8 codebase, both reachable without authentication. SQL injection escalating to RCE is possible when the underlying database driver or the application layer can be tricked into running OS-level commands — a pattern enabled by stacked queries or xp_cmdshell equivalents in embedded databases. Both flaws are rated 10.0, indicating HPE assessed the full RCE chain is achievable.

Buffer Overflows (CVE-2026-79847, CVE-2026-79851): On AOS-10, two unauthenticated buffer overflows exist in network-reachable services. Buffer overflows in embedded network OS code are highly reliable exploit targets: they can be used to overwrite control-flow data and redirect execution to attacker-controlled code, with no heap spray complexity in deterministic memory layouts. Without modern mitigations such as full ASLR/PIE and stack canaries — harder to guarantee on embedded firmware — these become trivially weaponizable after a single public PoC.

HPE’s advisory notes that some flaws require “preconditions outside of the attacker’s control” to be met, but crucially does not specify what those preconditions are. In practice, until those constraints are detailed, security teams should treat all eight flaws as unconditionally exploitable — that is the conservative, professionally defensible stance.

Am I Affected? Versions and Scope

The following builds are vulnerable:

• AOS-10: All 10.8.x builds up to and including 10.8.1.1; all 10.7.x up to 10.7.2.6; all 10.4.x up to 10.4.1.13
• AOS-8: All 8.13.x up to and including 8.13.3.0; all 8.10.x up to 8.10.0.23

Any hardware, virtual appliance, or cloud-managed instance running these builds is in scope — Mobility Conductors, Mobility Controllers, Mobility Gateways, and access points that inherit OS images from controllers. If you have a Aruba Central-managed fleet, check your assigned firmware baseline in Central before assuming cloud management equals automatic patching; Central does not auto-upgrade firmware without administrator action.

According to the advisory covered by Rescana’s detailed analysis, the fixed builds are:

• AOS-10.8.1.2 or later
• AOS-10.7.2.7 or later
• AOS-10.4.1.14 or later
• AOS-8.13.3.1 or later
• AOS-8.10.0.24 or later

Verify exact build numbers and download links directly in the official HPE security bulletin before upgrading.

What You Should Do Now — Sanjay Seth’s Defensive Playbook

Eight CVSS 10.0 vulnerabilities in network infrastructure deserve an emergency response posture, not a routine change ticket. Here is what I recommend to every client running HPE Aruba:

1. Immediate: Segment management interfaces. HPE’s workaround — and the most impactful single action you can take right now — is to ensure that all Aruba management interfaces (AOS-8 WebUI, CLI, PAPI) are accessible only from a dedicated, firewalled Out-of-Band Management (OOBM) network. No management interface should be reachable from a production VLAN, guest network, or the internet. If your architecture allows lateral reach to PAPI from any corporate VLAN, that is your immediate crisis.
2. Inventory all affected devices within 24 hours. Pull firmware versions from every Mobility Conductor, Controller, Gateway, and managed AP in your estate. Central’s firmware reporting dashboard and the CLI command show version will give you version strings. Cross-reference against the affected-version table above. Prioritise devices that are management-reachable from broader network segments.
3. Patch controllers and conductors before APs. In AOS-8 hierarchies, the Mobility Conductor orchestrates controller upgrades; patch the Conductor first, then push controller upgrades in batches. APs update automatically once the controller is on a fixed build. In AOS-10 / Central deployments, push the new firmware group baseline and deploy to device groups in staged rollouts to minimise outage windows.
4. Enable PAPI Security / Enhanced PAPI Security. For AOS-8 deployments not yet running Enhanced PAPI Security (shared secret-based authentication between controller and AP), enable it now — it is a documented Aruba feature and reduces the blast radius of PAPI-class exploits even on unpatched builds.
5. Enable audit logging and review for anomalies. Look for unexpected management logins, configuration changes, new administrator accounts, and unusual traffic to/from controller management IPs. If you have a SIEM, create alerts for ArubaOS syslog events around authentication failures and configuration changes for the next 30 days. The absence of known public exploits does not mean no one has reverse-engineered the patch.
6. Apply zero-trust principles to your wireless infrastructure. In my experience working with Indian enterprises on zero-trust campus architectures, network control-plane isolation is consistently the gap that converts a patched CVE into a lateral-movement incident. The management plane must be treated as a separate trust domain — segment it, authenticate every access, and log everything.

The India Context: Why This Matters for Domestic Enterprises

HPE Aruba is one of the three dominant wireless networking platforms in Indian enterprises, alongside Cisco and Fortinet. It holds particular market share in education, government, BFSI, and large campus deployments — sectors where Wi-Fi controller infrastructure is often refreshed on 5–7 year cycles, meaning many deployed systems run older but still-vendor-supported AOS-8 builds.

India’s CERT-In Vulnerability Note system has not yet issued a specific advisory on HPESBNW05162 as of this writing, but the mandatory 6-hour incident-reporting timeline under CERT-In’s 2022 directions means any exploitation of these flaws must be reported if it results in a breach. Given the volume and severity of the CVEs, I expect CERT-In will issue a formal note imminently.

Indian organisations with hybrid SD-WAN and campus networking deployments should note that a compromised Aruba gateway or controller sits at the intersection of user access, application traffic, and the SD-WAN overlay — making it one of the highest-value targets in the modern enterprise architecture.

Frequently Asked Questions

Are these vulnerabilities already being exploited in the wild?

As of HPE’s advisory publication on 22 October 2026, HPE stated it is not aware of any public exploit code or active exploitation targeting these CVEs. However, this window is typically short once a vendor advisory is public — security researchers and threat actors alike reverse-engineer patched binaries to reconstruct exploit paths. The absence of known exploitation today should not be interpreted as safety; it is a race condition, and patching is how you win it.

Does cloud-managed (Aruba Central) mean I’m automatically protected?

No. HPE Aruba Central is a management platform, not an auto-patching mechanism. While Central provides the console to push firmware updates, it does not push new firmware to devices automatically or without administrator action. You must review your firmware groups in Central, update the baseline to a fixed build, and deploy the update to each device group. Check your Central firmware compliance dashboard today.

What is the PAPI interface and why is it a recurring target?

PAPI (Process Application Programming Interface) is Aruba’s internal UDP-based communication protocol used between the controller and managed devices. It runs on UDP port 8211 and historically has been a target for authentication-bypass exploits because it is often reachable within the same LAN segment as managed devices. Multiple earlier CVEs in Aruba have involved PAPI. The recurring nature of PAPI-class vulnerabilities makes the Enable Enhanced PAPI Security configuration a mandatory baseline hardening step for any AOS-8 deployment, regardless of patch status.

What are the potential consequences of a successful exploit?

A successful exploit of any of the eight CVSS 10.0 CVEs gives an attacker full operating system control of the Aruba controller or gateway. From that position, an attacker can: intercept and decrypt all Wi-Fi traffic passing through the device; create rogue administrator accounts; modify routing and policy configurations; pivot into the management network; deploy persistent backdoors in the firmware; and disable security controls for other devices managed by the compromised controller. In a campus or enterprise context, a single compromised Mobility Conductor can cascade into control of every downstream controller and access point in the hierarchy.

For more context on how infrastructure vulnerabilities are chained in modern attacks, see SecurityWeek’s analysis of October 2026’s record-breaking Microsoft Patch Tuesday, which underscores how infrastructure-level flaws dominate today’s threat landscape.

---

Get a Security Assessment Before an Attacker Gets In First

If your organisation runs HPE Aruba networking — or any combination of campus, SD-WAN, and wireless infrastructure — the window between a public advisory and the first weaponised exploit is measured in days, not weeks. I offer rapid security assessments covering wireless and network infrastructure posture, management-plane segmentation gaps, and firmware lifecycle governance, tailored specifically for Indian enterprises.

Contact Sanjay Seth for a security consultation →

Whether you need an urgent vulnerability assessment, a zero-trust architecture review, or help building a credible patch management programme for your networking infrastructure, reach out today. The best time to assess your exposure is before an incident — the second-best time is right now.