HPE patches 72 ArubaOS flaws, including eight max-severity auth bypass and RCE bugs in AOS-8 and AOS-10
Hewlett Packard Enterprise (HPE) released updates for 72 vulnerabilities in ArubaOS (AOS), the operating system behind Aruba Networking wireless infrastructure such as mobility conductors, access points, controllers and gateways. Eight of the flaws are rated maximum severity and allow authentication bypass and code execution. They affect multiple AOS-8 and AOS-10 versions and can be exploited remotely, without privileges or user interaction, in low-complexity attacks. HPE says it has found no public proof-of-concept code and no evidence of exploitation in the wild. It urges customers to patch quickly because of the breadth and impact of the flaws.
Entenda a falha
A vulnerabilidade
HPE fixed 72 vulnerabilities in ArubaOS (AOS), the operating system of Aruba Networking mobility conductors, access points, controllers and gateways. Eight are rated maximum severity and allow authentication bypass and code execution. They affect multiple AOS-8 and AOS-10 versions. An attacker needs only network reach: no privileges, no user interaction, low complexity. The articles give no CVE IDs (they are in a table in the HPE advisory) and no exact affected or fixed version numbers.
Como funciona
The articles do not describe how the vulnerable code works. They say only that the eight flaws can be triggered remotely by an unauthenticated attacker, with no user action. The HPE mitigation advice points to the CLI and web-based management interfaces as the exposed surface. The step where processing fails is not detailed in the sources.
Por que é vulnerável
The articles do not state the root cause of any of the eight flaws. Given the impact (authentication bypass and code execution), the exposed management interfaces are the relevant surface, but the specific weakness types, why they went unnoticed and what each patch changes are not described. Details should be in the HPE advisory.
Como foi descoberta
HPE disclosed the flaws in a security advisory published on a Thursday, alongside the patches. The articles do not say who found them or how they were reported. HPE says it knows of no public discussion, public proof-of-concept code or exploitation in the wild as of the advisory date.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 10:16.
Detalhes técnicos
- The eight maximum-severity issues are unauthenticated, remotely exploitable, low-complexity and need no user interaction.
- The article does not list CVE identifiers; they are in a table in the HPE advisory.
- HPE is not aware of public discussion or exploit code for the listed flaws as of the advisory release date.
- Earlier HPE issues cited for context: critical StoreOnce flaws (June 2025), hardcoded credentials in Aruba Instant On access points (July 2025), a maximum-severity OneView flaw that CISA flagged as exploited (January 2025), and critical AOS-CX flaws allowing admin password resets and RCE.
Remediação
- Apply the HPE security updates for AOS-8 and AOS-10 as soon as possible.
- Restrict the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN, and/or control them with firewall policies at layer 3 and above.
- Enable accounting controls to track and log user activity and resource usage.
Linha do tempo
-
HPE patches 72 ArubaOS flaws, including eight max-severity auth bypass and RCE bugs in AOS-8 and AOS-10
ler a análise desta fonte ocultar
Hewlett Packard Enterprise (HPE) released updates for 72 vulnerabilities in ArubaOS (AOS), the operating system behind Aruba Networking wireless infrastructure such as mobility conductors, access points, controllers and gateways. Eight of the flaws are rated maximum severity and allow authentication bypass and code execution. They affect multiple AOS-8 and AOS-10 versions and can be exploited remotely, without privileges or user interaction, in low-complexity attacks. HPE says it has found no public proof-of-concept code and no evidence of exploitation in the wild. It urges customers to patch quickly because of the breadth and impact of the flaws.
Technical Details
- The eight maximum-severity issues are unauthenticated, remotely exploitable, low-complexity and need no user interaction.
- The article does not list CVE identifiers; they are in a table in the HPE advisory.
- HPE is not aware of public discussion or exploit code for the listed flaws as of the advisory release date.
- Earlier HPE issues cited for context: critical StoreOnce flaws (June 2025), hardcoded credentials in Aruba Instant On access points (July 2025), a maximum-severity OneView flaw that CISA flagged as exploited (January 2025), and critical AOS-CX flaws allowing admin password resets and RCE.
Remediation
- Apply the HPE security updates for AOS-8 and AOS-10 as soon as possible.
- Restrict the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN, and/or control them with firewall policies at layer 3 and above.
- Enable accounting controls to track and log user activity and resource usage.