/
← Voltar ao feed
critical

HPE patches 72 Aruba AOS-8/AOS-10 flaws, including CVE-2026-79855 SSH auth bypass and eight max-severity RCE/auth bypass bugs

2 fonte(s) · 2 atualização(ões) · publicado 23/10/2026 09:15 · coletado há 17 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:03; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ bleepingcomputer.com ↗

Hewlett Packard Enterprise (HPE) released security bulletin HPESBNW05162 on October 22, 2026, fixing 72 vulnerabilities in ArubaOS (AOS), specifically AOS-8 and AOS-10, the operating system behind Aruba Networking mobility conductors, controllers, gateways and access points. The most prominent is CVE-2026-79855, a CVSS 9.8 authentication bypass in the SSH daemon that lets a remote, unauthenticated attacker gain administrative privileges (gbhackers.com). Eight of the flaws are rated maximum severity (CVSS 10.0), allowing authentication bypass and code execution; they are remotely exploitable without privileges or user interaction in low-complexity attacks (bleepingcomputer.com). HPE says it knows of no public discussion, proof-of-concept or exploit code and no evidence of exploitation in the wild as of release (bleepingcomputer.com, gbhackers.com). It nonetheless urges customers to patch quickly because of the breadth and potential impact.

Entenda a falha

A vulnerabilidade

HPE bulletin HPESBNW05162 (October 22, 2026) fixes 72 flaws in ArubaOS AOS-8 and AOS-10. The most prominent is CVE-2026-79855 (CVSS 9.8), an authentication bypass in the SSH daemon, which gbhackers describes as part of AOS-8. A remote attacker with network access, no credentials and no user interaction gets administrative privileges and can fully compromise the host. CVE-2026-79860 is a PAPI flaw reached with crafted packets on UDP port 8211. BleepingComputer counts eight flaws at CVSS 10.0 (authentication bypass and code execution, unauthenticated, low complexity). Affected: AOS-10 10.8.1.1, 10.7.2.6 and 10.4.1.13 and earlier; AOS-8 8.13.3.0 and 8.10.0.23 and earlier, across conductors, controllers, gateways and access points. Fixed in AOS-10 10.8.1.2, 10.7.2.7, 10.4.1.14 and AOS-8 8.13.3.1, 8.10.0.24.

Como funciona

The articles do not describe the internal mechanism in detail. For CVE-2026-79855, a remote connection reaches the device's SSH daemon and the authentication step can be bypassed, so the attacker is treated as an administrator. For CVE-2026-79860, crafted packets sent to UDP port 8211 reach PAPI, the access-point management protocol, which mishandles them. Other PAPI flaws are described as command injection, SQL injection, buffer overflow or authentication bypass. Exactly where each one fails is not stated.

Por que é vulnerável

The articles give no root cause for any individual CVE. They only classify the 72 flaws as authentication bypass, command and SQL injection, buffer overflow, memory corruption, path traversal, information disclosure, XSS, file manipulation and denial of service. The fix ships as new software releases, and what changed in the code is not described. HPE cites the complexity and breadth of the flaws as the reason to patch quickly.

Onde está

The articles name the SSH daemon (CVE-2026-79855) and the PAPI management protocol on UDP port 8211 (CVE-2026-79860), but no files, functions or commits.

Como foi descoberta

HPE credited its internal networking security researchers for finding the SSH authentication bypass. The flaws were disclosed through the HPE security bulletin HPESBNW05162, published on October 22, 2026. HPE said it knew of no public discussion or exploit code as of the release date, and BleepingComputer reports no evidence of exploitation in the wild. HPE still urges rapid patching because of the complexity, breadth and impact of the flaws.

Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 00:19.

Detalhes técnicos

  • The bulletin covers authentication bypass, command and SQL injection, buffer overflow, memory corruption, path traversal, information disclosure, XSS, file manipulation and DoS (gbhackers.com).
  • Particularly concerning flaws affect the PAPI access-point management protocol. CVE-2026-79860 targets UDP port 8211 with crafted packets; other PAPI flaws allow command injection, SQL injection, buffer overflow or authentication bypass (gbhackers.com).
  • Affected AOS-10 versions: 10.8.1.1 and earlier, 10.7.2.6 and earlier, 10.4.1.13 and earlier (gbhackers.com).
  • Affected AOS-8 versions: 8.13.3.0 and earlier, 8.10.0.23 and earlier (gbhackers.com).
  • Affected products include Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points and virtual deployments (gbhackers.com).
  • HPE credited its internal networking security researchers (gbhackers.com). The full CVE list is in a table in the HPE advisory; bleepingcomputer.com does not list identifiers.
  • Context cited by bleepingcomputer.com: earlier HPE issues include critical StoreOnce flaws (June 2025), hardcoded credentials in Aruba Instant On access points (July 2025), a maximum-severity OneView flaw that CISA flagged as exploited (January 2025), and critical AOS-CX flaws allowing admin password resets and RCE.

Remediação

  • Upgrade to AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14 depending on branch; AOS-8 users should move to 8.13.3.1 or 8.10.0.24 (gbhackers.com).
  • If immediate upgrade is not possible, restrict CLI and web-management interfaces to a dedicated Layer 2 segment/VLAN and/or control them with Layer 3+ firewall policies, and enable accounting to log user activity and resource usage (gbhackers.com, bleepingcomputer.com). These measures reduce exposure but do not replace patching.
  • Inventory physical and virtual instances and verify versions, review firewall and authentication logs for management access, prioritize internet-reachable systems, and rotate credentials if compromise is suspected (gbhackers.com).

Linha do tempo

  1. gbhackers.com ↗ · pub. 23/10/2026 09:15 · coletado 23/10 10:00

    HPE patches 72 Aruba AOS-8/AOS-10 flaws, including CVE-2026-79855 SSH authentication bypass (CVSS 9.8) and CVSS 10 unauthenticated RCE

    ler a análise desta fonte

    Hewlett Packard Enterprise (HPE) released security bulletin HPESBNW05162 on October 22, 2026, covering 72 vulnerabilities in Aruba AOS-8 and AOS-10. The most prominent is CVE-2026-79855, a CVSS 9.8 authentication bypass in the SSH daemon that lets a remote, unauthenticated attacker obtain administrative privileges and fully compromise a host. Several other flaws score the maximum CVSS 10.0 and allow unauthenticated remote code execution. HPE credited its internal networking security researchers and said it knew of no public discussion or exploit code at release time. Even so, it urged rapid patching because of the breadth and potential impact.

    Technical Details

    • The bulletin spans authentication bypass, command and SQL injection, buffer overflow, memory corruption, path traversal, information disclosure, XSS, file manipulation and DoS.
    • Particularly concerning flaws affect the PAPI access-point management protocol. CVE-2026-79860 targets UDP port 8211 with crafted packets. Other PAPI flaws allow command injection, SQL injection, buffer overflow or authentication bypass.
    • Affected AOS-10 versions: 10.8.1.1 and earlier, 10.7.2.6 and earlier, 10.4.1.13 and earlier.
    • Affected AOS-8 versions: 8.13.3.0 and earlier, 8.10.0.23 and earlier.
    • Affected products include Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points and virtual deployments.

    Remediation

    • Upgrade to AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14, depending on the branch. AOS-8 users should move to 8.13.3.1 or 8.10.0.24.
    • If an immediate upgrade is not possible, isolate CLI and web-management interfaces on a dedicated Layer 2 segment or VLAN, enforce Layer 3 or higher firewall controls, and enable accounting to log user activity. These measures reduce exposure but do not replace patching.
    • Inventory physical and virtual instances and verify their versions. Review firewall and authentication logs for management access. Prioritize internet-reachable systems, and rotate credentials if compromise is suspected.
  2. bleepingcomputer.com ↗ · pub. 23/10/2026 09:48 · coletado 23/10 10:00 primeiro registro

    HPE patches 72 ArubaOS flaws, including eight max-severity auth bypass and RCE bugs in AOS-8 and AOS-10

    ler a análise desta fonte

    Hewlett Packard Enterprise (HPE) released updates for 72 vulnerabilities in ArubaOS (AOS), the operating system behind Aruba Networking wireless infrastructure such as mobility conductors, access points, controllers and gateways. Eight of the flaws are rated maximum severity and allow authentication bypass and code execution. They affect multiple AOS-8 and AOS-10 versions and can be exploited remotely, without privileges or user interaction, in low-complexity attacks. HPE says it has found no public proof-of-concept code and no evidence of exploitation in the wild. It urges customers to patch quickly because of the breadth and impact of the flaws.

    Technical Details

    • The eight maximum-severity issues are unauthenticated, remotely exploitable, low-complexity and need no user interaction.
    • The article does not list CVE identifiers; they are in a table in the HPE advisory.
    • HPE is not aware of public discussion or exploit code for the listed flaws as of the advisory release date.
    • Earlier HPE issues cited for context: critical StoreOnce flaws (June 2025), hardcoded credentials in Aruba Instant On access points (July 2025), a maximum-severity OneView flaw that CISA flagged as exploited (January 2025), and critical AOS-CX flaws allowing admin password resets and RCE.

    Remediation

    • Apply the HPE security updates for AOS-8 and AOS-10 as soon as possible.
    • Restrict the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN, and/or control them with firewall policies at layer 3 and above.
    • Enable accounting controls to track and log user activity and resource usage.