THE CRUNCH
HPE has released patches for 72 vulnerabilities across the AOS-8 and AOS-10 wireless operating systems used in its Aruba networking products, including 33 rated critical and eight given the maximum severity rating. The worst of the lot, tracked as CVE-2026-79844 through CVE-2026-79851, could let attackers who need no credentials achieve remote code execution, bypass authentication to gain administrative privileges, run arbitrary commands and fully compromise affected systems.
The fixed versions, 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2, have rolled out across mobility conductor, controller, gateway and access point products. HPE notes that any compatible hardware, mobility solutions, access points or virtual machines running the vulnerable operating systems are affected.
Beyond the eight top-rated bugs, the updates cover the remaining critical flaws, which carry similar risks including information disclosure, file tampering and complete system compromise, plus 31 high-severity issues, of which more than a dozen need no authentication, eight medium-severity flaws and one low-severity weakness.
HPE says it is not aware of any of the vulnerabilities being exploited in the wild, but is urging customers to patch quickly. As a stopgap, it recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN and/or controlling them with layer 3 or higher firewall policies, along with accounting controls for tracking and logging user activities and resource usage.