HPE fixes eight maximum-severity flaws in its wireless operating systems
The bulletin covers 72 vulnerabilities across controllers, gateways and access points running AOS-10 and AOS-8, and HPE says it has seen no public exploit code for any of them
- Bulletin: HPESBNW05162 rev.1, issued by the HPE Product Security Response Team
- Maximum-severity CVEs: CVE-2026-79844 to CVE-2026-79851, each scored 10.0
- Severity split: 33 critical, 31 high, seven medium, one low
- Fixed releases: AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14; AOS-8.13.3.1 and 8.10.0.24
HPE lists Mobility Conductors, Mobility Controllers, Mobility Gateways managed through HPE Networking Central, AOS-10 access points and AOS-8 Instant access points. Vulnerable releases run up to AOS-10.8.1.1, 10.7.2.6 and 10.4.1.13, and up to AOS-8.13.3.0 and 8.10.0.23; HPE says any hardware or virtual machine compatible with those versions is affected, including models its list leaves out. Releases past End of Maintenance are presumed affected but fall outside the bulletin, and HPE has not assessed exposure for those past End of Support.
“Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.”HPE Networking, security bulletin HPESBNW05162
HPE released fixed versions of its AOS-10 and AOS-8 wireless operating systems on 22 October, closing holes that in the worst cases let an attacker with no login run commands on a device as a privileged user.
The eight top-rated flaws need no credentials, no user interaction and no foothold inside the network, according to the scoring vectors in the bulletin. They span authentication bypass, command injection, buffer overflows and SQL injection. Seven can end in code execution on the underlying operating system; the eighth, in PAPI, which HPE describes as Aruba’s access point management protocol, lets an attacker gain administrative access, change system configurations and reach sensitive data. A further group can be exploited only by an attacker on an adjacent network segment. Several flaws in both groups sit in PAPI.
Found mostly in-house
HPE credits most of the findings to internal security research at HPE Networking. Others came through its bug bounty program, from researchers including one named moonv, who shares credit for two of the maximum-severity SQL injection flaws. Researchers at Siemens Energy are credited with one command injection flaw.
Until upgrades are in place, HPE’s stated workaround is to confine the command line and web management interfaces to a dedicated layer 2 segment or VLAN, or to control them with firewall policies at layer 3 and above, with accounting controls that log user activity.
Sources
- HPE, “HPESBNW05162 rev.1 – Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)”, security bulletin, 22 October 2026. https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- BleepingComputer, “HPE patches eight max severity RCE and auth bypass AOS flaws”, Sergiu Gatlan, 23 October 2026. https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
