HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices

Hewlett Packard Enterprise has released security patches for multiple vulnerabilities in Aruba Networking wireless software that could let attackers take complete control of affected devices.

The flaws affect AOS-8 and AOS-10 deployments across Mobility Conductors, Controllers, Gateways, and access points. Several allow attacks without a valid login, making prompt patching a priority for network administrators.

HPE Warns Aruba Networking Flaws

HPE’s October 22 security bulletin, HPESBNW05162, describes authentication bypass, command injection, SQL injection, and buffer overflow flaws.

Eight CVE entries carry the maximum CVSS severity score of 10.0. Successful attacks could expose sensitive data, change device settings, or run commands with high system privileges.

Among the most serious issues, CVE-2026-79850 lets an attacker bypass AOS-8 authentication without credentials and execute commands as root, giving them full control of the underlying operating system. CVE-2026-79855 separately affects the AOS-8 SSH service and can grant unauthenticated administrative access.

AOS-10 also contains critical weaknesses. CVE-2026-79845 affects PAPI, Aruba’s access point management protocol, and could let attackers bypass login checks, change configurations, and access sensitive information.

CVE-2026-79847 and CVE-2026-79851 involve buffer overflows that could allow malicious code to run with privileged permissions. Other flaws expose services reached through PAPI traffic. Attackers can trigger CVE-2026-79860 by sending specially crafted packets to UDP port 8211 on affected AOS-8 systems.

HPE also lists SQL injection flaws that could extend beyond database access and allow command execution on the operating system. The attack conditions vary. Some vulnerabilities can be reached remotely, while others require an attacker on an adjacent network or physical access.

Certain command execution flaws also depend on conditions outside the attacker’s control. Not every listed issue provides the same route to device takeover.

Cybersecurity News previously reported on Aruba access point command injection vulnerabilities and AOS controller and gateway security flaws. Those earlier reports concern separate disclosures, not the newly released fixes.

The affected releases include AOS-10.8.1.1, AOS-10.7.2.6, and AOS-10.4.1.13 and earlier versions within their respective branches. AOS-8.13.3.0 and AOS-8.10.0.23 and earlier releases in those branches are also affected. Compatible hardware and virtual deployments fall within scope, even when individual models are absent from the bulletin’s example list.

HPE recommends upgrading to AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, or AOS-8.10.0.24, depending on the installed branch. Later releases in those branches also contain the fixes. Updates are available through the HPE Networking Support Portal.

Until updates are deployed, HPE recommends restricting command line and web management interfaces to a dedicated network segment or VLAN, backed by firewall rules.

Administrators should also enable controls that track and log user activity. These measures reduce exposure but do not replace installing the patches.

HPE said it knew of no public discussion or exploit code targeting these vulnerabilities when the advisory was released. That statement does not establish whether attacks have occurred. Older software beyond maintenance or support should not be assumed safe, and HPE urges customers to move to supported releases.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices appeared first on Cyber Security News.