As reported by BleepingComputer, HPE has released patches for 72 vulnerabilities in ArubaOS (AOS), eight of which carry maximum severity ratings. These flaws span authentication bypass, command injection, buffer overflow, and SQL injection — all capable of enabling remote code execution on the very devices that anchor enterprise wireless and network infrastructure. This is a significant event for any organization running Aruba mobility controllers, access points, or gateways.
Why This Matters More Than a Typical Patch Tuesday
Network infrastructure devices are force multipliers for attackers. A compromised Aruba controller doesn't just give an adversary a foothold — it gives them a position on the management plane of your entire wireless network. They can intercept traffic, pivot to internal segments, manipulate VLAN configurations, and persist through firmware-level access that survives standard host remediation. The fact that all eight critical flaws are remotely exploitable without credentials or user interaction raises the urgency substantially.
HPE notes that no public PoC exploits or active exploitation has been observed as of the advisory's release date. However, the window between advisory publication and in-the-wild exploitation for network device vulnerabilities has been shrinking consistently. Threat actors — particularly ransomware affiliates and state-sponsored groups — increasingly target unpatched edge devices as initial access vectors, as demonstrated by the 2025 exploitation of HPE OneView flagged by CISA.
Vulnerability Summary
| CVE-ID | Type | Affected | Severity |
|---|---|---|---|
| CVE-2026-79844 | Auth Bypass → RCE | AOS-10 | Critical |
| CVE-2026-79845 | Auth Bypass (PAPI Protocol) | AOS-10 | Critical |
| CVE-2026-79846 | Unauth Command Injection | AOS-8 | Critical |
| CVE-2026-79847 | Unauth Buffer Overflow → RCE | AOS-10 | Critical |
| CVE-2026-79848 | Unauth SQL Injection → RCE | AOS-8 | Critical |
| CVE-2026-79849 | Unauth SQL Injection → RCE | AOS-8 | Critical |
| CVE-2026-79850 | Auth Bypass → RCE | AOS-8 | Critical |
| CVE-2026-79851 | Unauth Buffer Overflow → RCE | AOS-10 | Critical |
- Affected Products:
- HPE ArubaOS 8.x and 10.x — mobility conductors, access points, controllers, and gateway devices
- Exploitation Status:
- No confirmed active exploitation or public PoC as of October 23, 2026
- Attack Complexity:
- Low — no privileges or user interaction required
- Patch Availability:
- Yes — available via HPE software update channels
Who Is Most at Risk
The PAPI protocol vulnerability (CVE-2026-79845) deserves particular attention. Aruba's PAPI protocol is used for management communication between controllers and access points. An authentication bypass in this protocol could allow an attacker to inject commands into the control plane of the wireless network itself — not just a single device.
Shield53 Recommendations
Immediate Actions
- Patch now: Update all AOS-8 and AOS-10 devices to the fixed versions released in HPE's October 2026 advisory. Prioritize controllers and mobility conductors first, as they manage the broadest attack surface.
- Isolate management interfaces: Restrict CLI and web-based management to a dedicated management VLAN with strict layer-3 firewall controls. No AOS management interface should be internet-facing.
- Inventory and verify: Run a full inventory of all Aruba devices. Confirm firmware versions across the estate — edge APs are frequently missed in patching cycles.
- Enable logging and alerting: Ensure accounting controls and session logging are active on all management interfaces. Configure alerts for authentication failures, PAPI anomalies, and unexpected CLI sessions.
Detection Recommendations
- Monitor for unexpected PAPI traffic from non-controller sources on management VLANs.
- Watch for SQL injection patterns in web management logs — CVE-2026-79848 and CVE-2026-79849 both involve SQLi vectors.
- Alert on new or unexpected CLI sessions, particularly outside change-management windows.
- Correlate buffer overflow signatures against AOS device IPs — IDS/IPS signatures for the affected AOS versions should be deployed immediately.
Strategic Posture
This advisory reinforces a broader trend: network infrastructure devices are now prime targets for initial access. Organizations should treat ArubaOS updates with the same urgency as domain controller or firewall patches. If you're still running AOS-8, accelerate your migration planning to AOS-10 — the vulnerability density in the legacy branch will only increase over time. Additionally, ensure your incident response runbooks include scenarios for compromised network infrastructure, as these require fundamentally different containment and eradication procedures than endpoint-focused playbooks.
