HPE Patches 72 ArubaOS Flaws, Eight at Max Severity

HPE has released a security bulletin for Aruba Operating System covering 72 vulnerabilities in AOS, eight of them classified at maximum severity. The affected products span ArubaOS mobility conductors, access points, controllers, and gateway devices running either AOS-8 or AOS-10.

Maximum severity flaws

The eight maximum-severity CVEs (CVE-2026-79844 through CVE-2026-79851) split across two categories: authentication bypass and unauthenticated remote code execution. Both AOS-8 and AOS-10 branches are affected, with paths ranging from unauthenticated command injection and buffer overflow to SQL injection. This mix of auth bypass and unauthenticated RCE is the kind of combination that should move enterprise patching queues, not sit at the bottom of them.

HPE stated in the advisory that it is not aware of any public exploit code or active exploitation targeting these vulnerabilities as of the release date.

CVE-2026-79852: the management interface SQL injection

A separate entry in the same advisory, CVE-2026-79852 carries a CVSS score of 9.8 (critical). It is a SQL injection flaw in the web-based management interface that lets an unauthenticated remote attacker access privileged internal functionality and gain operator privileges. Networks where the management interface faces untrusted segments should treat this one as a near-term priority even without confirmed in-the-wild activity.

What to do

HPE recommends restricting CLI and web management interface access to dedicated network segments and applying firewall controls to limit exposure. Patching AOS to the fixed versions in the HPE advisory removes the risk entirely. Both AOS-8 and AOS-10 have patched branches.

Enterprise network infrastructure has a well-documented tendency to sit unpatched longer than endpoint software. Change-control friction plays a part, but so does the assumption that once a device is deployed it runs unsupervised. A bulletin covering 72 CVEs, eight at maximum severity and one at CVSS 9.8, is a reasonable occasion to revisit that assumption.

For context on similar large-batch enterprise network patches, see last week’s Cisco Patches 34 CVEs, Six Critical Across Products and September’s HPE Patches CVSS 9.8 RCE in ArubaOS-CX Switches. The pattern of large advisory drops for enterprise networking gear is not new. The question is always whether the organizations running the gear respond at the speed the severity warrants. On this one, the answer should be yes.