EN PT-BR
← Voltar ao feed
critical exploit público

HPE patches 72 Aruba AOS-8/AOS-10 flaws, including CVE-2026-79855 SSH auth bypass and eight max-severity RCE/auth bypass bugs

4 fonte(s) · 4 atualização(ões) · publicado 22/10/2026 21:00 · coletado há 5 dias

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 27/10/2026 11:01; os links antigos trazem para cá.

Fontes: securityweek.com ↗ cert.cyber.gouv.fr ↗ gbhackers.com ↗ bleepingcomputer.com ↗

Hewlett Packard Enterprise (HPE) released security bulletin HPESBNW05162 on October 22, 2026, fixing 72 vulnerabilities in ArubaOS (AOS), specifically AOS-8 and AOS-10, the operating system behind Aruba Networking mobility conductors, controllers, gateways and access points. The most prominent is CVE-2026-79855, a CVSS 9.8 authentication bypass in the SSH daemon that lets a remote, unauthenticated attacker gain administrative privileges (gbhackers.com). Eight of the flaws are rated maximum severity (CVSS 10.0), allowing authentication bypass and code execution; they are remotely exploitable without privileges or user interaction in low-complexity attacks (bleepingcomputer.com). SecurityWeek names them as CVE-2026-79844 through CVE-2026-79851 and reports that 33 of the 72 flaws are critical, 31 high (over a dozen exploitable without authentication), eight medium and one low (securityweek.com). HPE says it knows of no public discussion, proof-of-concept or exploit code and no evidence of exploitation in the wild as of release (bleepingcomputer.com, gbhackers.com, securityweek.com). It nonetheless urges customers to patch quickly because of the breadth and potential impact. On October 23, 2026, CERT-FR published advisory CERTFR-2026-AVI-1369, which covers AOS and also ClearPass Policy Manager (6.11 and 6.14) under a second HPE bulletin, HPESBNW05171, and references about 80 CVEs in total; it reports no active exploitation (cert.cyber.gouv.fr).

Entenda a falha

A vulnerabilidade

HPE bulletin HPESBNW05162 (22 Oct 2026) fixes 72 flaws in ArubaOS AOS-8 and AOS-10, which runs Aruba conductors, controllers, gateways and access points. The worst are eight CVSS 10.0 bugs, CVE-2026-79844 to CVE-2026-79851 (named by SecurityWeek), allowing authentication bypass and code execution remotely, without privileges or user interaction. CVE-2026-79855 (CVSS 9.8) is an authentication bypass in the AOS-8 SSH daemon that gives a remote, unauthenticated attacker administrative privileges. CVE-2026-79860 hits the PAPI protocol on UDP 8211, and other PAPI flaws allow command or SQL injection, buffer overflow or auth bypass. SecurityWeek counts 33 critical, 31 high, 8 medium and 1 low (sums to 73). Affected: AOS-10 up to 10.8.1.1, 10.7.2.6, 10.4.1.13; AOS-8 up to 8.13.3.0, 8.10.0.23. Fixed in 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1, 8.10.0.24. CERT-FR also lists ClearPass 6.11 and 6.14 under bulletin HPESBNW05171.

Como funciona

The articles give no step-by-step mechanism. For CVE-2026-79855, a remote client reaches the SSH daemon of AOS-8 over the network and the authentication step can be bypassed, so the attacker gets administrative privileges without credentials. For CVE-2026-79860, crafted packets are sent to the PAPI access-point management protocol on UDP port 8211. Other PAPI flaws are described only by class (command injection, SQL injection, buffer overflow, auth bypass). Which step fails in each of the 72 CVEs is not stated.

Por que é vulnerável

The articles do not state root causes per CVE or why they went unnoticed. The bulletin's classes (authentication bypass, command and SQL injection, buffer overflow, memory corruption, path traversal, information disclosure, XSS, file manipulation, DoS) suggest missing authentication checks, unsanitized input and unsafe memory handling, but that is inferred from the classes, not stated per flaw. Exposed management interfaces increase the impact. The fix is upgrading to the patched releases.

Onde está

The articles name only components, not files or functions: the AOS-8 SSH daemon (CVE-2026-79855) and the PAPI protocol on UDP 8211 (CVE-2026-79860 and others); the full CVE table is in HPE bulletin HPESBNW05162.

Como foi descoberta

According to gbhackers.com, HPE credited its internal networking security researchers for CVE-2026-79855. The articles do not say who found the others or how. Disclosure came through HPE bulletins HPESBNW05162 and HPESBNW05171 on 22 October 2026, then media coverage and the CERT-FR advisory on 23 October. HPE says it knew of no public discussion, exploit code or exploitation in the wild at release, and CERT-FR reports no active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 11:16.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-52704 ↗ · remoto · php · pub. 22/10/2026 verificado

    PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

    This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.

    CVE-2026-109618 · autor: OffSec · explicação gerada por IA

Detalhes técnicos

  • The bulletin covers authentication bypass, command and SQL injection, buffer overflow, memory corruption, path traversal, information disclosure, XSS, file manipulation and DoS (gbhackers.com).
  • Besides the eight max-severity bugs, the remaining critical flaws could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access and complete system compromise (securityweek.com).
  • Particularly concerning flaws affect the PAPI access-point management protocol. CVE-2026-79860 targets UDP port 8211 with crafted packets; other PAPI flaws allow command injection, SQL injection, buffer overflow or authentication bypass (gbhackers.com).
  • Affected AOS-10 versions: 10.8.1.1 and earlier, 10.7.2.6 and earlier, 10.4.1.13 and earlier (gbhackers.com).
  • Affected AOS-8 versions: 8.13.3.0 and earlier, 8.10.0.23 and earlier (gbhackers.com).
  • Affected products include Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points and virtual deployments (gbhackers.com). HPE states that all hardware, mobility solutions, access points and VMs compatible with the vulnerable wireless operating systems are affected (securityweek.com).
  • HPE credited its internal networking security researchers (gbhackers.com). The full CVE list is in a table in the HPE advisory; bleepingcomputer.com does not list identifiers.
  • CERT-FR lists the impacts as remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass, data integrity and confidentiality compromise, SSRF and XSS (cert.cyber.gouv.fr).
  • CERT-FR lists affected versions as AOS 10.4.x.x before 10.4.1.14, 10.7.x.x before 10.7.2.7, 10.8.x.x before 10.8.1.2, 8.10.x.x before 8.10.0.24 and 8.13.x.x before 8.13.3.1, plus ClearPass Policy Manager 6.11.x before 6.11.16 and 6.14.x before 6.14.1 (cert.cyber.gouv.fr).
  • CERT-FR cites two vendor bulletins, both dated 22 October 2026: hpe_networking_-hpesbnw05162 and hpe_networking-_hpesbnw05171. It gives no CVSS scores and does not map each CVE to a specific flaw or product (cert.cyber.gouv.fr).
  • Context cited by bleepingcomputer.com: earlier HPE issues include critical StoreOnce flaws (June 2025), hardcoded credentials in Aruba Instant On access points (July 2025), a maximum-severity OneView flaw that CISA flagged as exploited (January 2025), and critical AOS-CX flaws allowing admin password resets and RCE.

Remediação

  • Upgrade to AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14 depending on branch; AOS-8 users should move to 8.13.3.1 or 8.10.0.24 (gbhackers.com, cert.cyber.gouv.fr). These releases fix all eight max-severity bugs and have been rolled out across mobility conductor, controller, gateway and access point products (securityweek.com).
  • ClearPass Policy Manager users should move to 6.11.16 (6.11 branch) or 6.14.1 (6.14 branch) per the HPE bulletin referenced by CERT-FR (cert.cyber.gouv.fr).
  • CERT-FR directs administrators to apply the fixed versions described in the HPE Aruba Networking security bulletins (cert.cyber.gouv.fr).
  • If immediate upgrade is not possible, restrict CLI and web-management interfaces to a dedicated Layer 2 segment/VLAN and/or control them with Layer 3+ firewall policies, and enable accounting to log user activity and resource usage (gbhackers.com, bleepingcomputer.com, securityweek.com). These measures reduce exposure but do not replace patching.
  • Inventory physical and virtual instances and verify versions, review firewall and authentication logs for management access, prioritize internet-reachable systems, and rotate credentials if compromise is suspected (gbhackers.com).

Relatos divergentes

  • Number of CVEs: bleepingcomputer.com and gbhackers.com describe 72 vulnerabilities fixed in AOS under HPESBNW05162, while cert.cyber.gouv.fr references about 80 CVEs. The difference is likely because the CERT-FR advisory also covers the ClearPass Policy Manager bulletin HPESBNW05171, but CERT-FR gives no per-CVE mapping, so this is unconfirmed. The HPE bulletin's own count for AOS (72) is the more authoritative for AOS alone.
  • Severity breakdown: securityweek.com reports 72 vulnerabilities but gives a severity breakdown of 33 critical, 31 high, eight medium and one low, which sums to 73. The discrepancy is unexplained; the HPE advisory table is the authoritative source for exact counts.

Linha do tempo

  1. securityweek.com ↗ · pub. 27/10/2026 10:13 · coletado 27/10 11:00

    HPE patches 72 Aruba AOS-8/AOS-10 flaws, 33 critical, including eight max-severity unauthenticated RCE and auth bypass bugs

    SecurityWeek adds the severity breakdown of the HPE release: 33 critical, 31 high (over a dozen exploitable without authentication), eight medium and one low. It also lists the eight max-severity CVEs (CVE-2026-79844 to CVE-2026-79851) and notes the breakdown sums to 73 against the stated 72 total.

    ler a análise desta fonte

    SecurityWeek adds the severity breakdown of the HPE release: 33 critical, 31 high (over a dozen exploitable without authentication), eight medium and one low. It also lists the eight max-severity CVEs (CVE-2026-79844 to CVE-2026-79851) and notes the breakdown sums to 73 against the stated 72 total.

    HPE released patches last week for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba Networking products, 33 of them critical-severity. Eight are max-severity: CVE-2026-79844 through CVE-2026-79851. They could let unauthenticated attackers achieve remote code execution, bypass authentication to gain administrative privileges, run arbitrary commands and fully compromise affected systems. HPE says it is not aware of exploitation in the wild but urges customers to patch as soon as possible.

    Technical Details

    • The eight max-severity bugs are CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850 and CVE-2026-79851.
    • The remaining critical flaws could lead to unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering, administrative access and full system compromise.
    • HPE also fixed 31 high-severity flaws (over a dozen exploitable without authentication), eight medium-severity flaws and one low-severity weakness.
    • All hardware, mobility solutions (conductors, controllers, gateways), access points and VMs compatible with the vulnerable wireless operating systems are affected.

    Remediation

    • Upgrade to AOS versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 or 10.8.1.2, which fix all eight max-severity bugs across mobility conductor, controller, gateway and access point products.
    • Restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or control them with layer 3+ firewall policies, with accounting controls to track and log user activity and resource usage.
  2. cert.cyber.gouv.fr ↗ · pub. 22/10/2026 21:00 · coletado 26/10 14:01

    CERT-FR flags multiple vulnerabilities in HPE Aruba Networking AOS and ClearPass Policy Manager, including remote code execution

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1369 on multiple vulnerabilities in HPE Aruba Networking products, namely AOS (8.x and 10.x branches) and ClearPass Policy Manager (6.11 and 6.14). According to the advisory, some flaws allow a remote attacker to execute arbitrary code, escalate privileges or cause a denial of service. Other impact categories listed are data integrity and confidentiality breaches, security policy bypass, SSRF and indirect remote code injection (XSS). The advisory references about 80 CVEs and two vendor bulletins dated 22 October 2026. It does not report active exploitation and gives no CVSS scores or per-CVE mapping.

    Technical Details

    • Impacts: remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass, data integrity and confidentiality compromise, SSRF, XSS.
    • Affected versions: AOS 10.4.x.x before 10.4.1.14, 10.7.x.x before 10.7.2.7, 10.8.x.x before 10.8.1.2, 8.10.x.x before 8.10.0.24 and 8.13.x.x before 8.13.3.1; ClearPass Policy Manager 6.11.x before 6.11.16 and 6.14.x before 6.14.1.
    • Vendor bulletins: hpe_networking_-hpesbnw05162 and hpe_networking-_hpesbnw05171, both dated 22 October 2026.
    • The advisory does not tie each CVE to a specific flaw or product.

    Remediation

    • Apply the fixed versions described in the HPE Aruba Networking security bulletins, as CERT-FR directs.
  3. gbhackers.com ↗ · pub. 23/10/2026 09:15 · coletado 23/10 10:00

    HPE patches 72 Aruba AOS-8/AOS-10 flaws, including CVE-2026-79855 SSH authentication bypass (CVSS 9.8) and CVSS 10 unauthenticated RCE

    ler a análise desta fonte

    Hewlett Packard Enterprise (HPE) released security bulletin HPESBNW05162 on October 22, 2026, covering 72 vulnerabilities in Aruba AOS-8 and AOS-10. The most prominent is CVE-2026-79855, a CVSS 9.8 authentication bypass in the SSH daemon that lets a remote, unauthenticated attacker obtain administrative privileges and fully compromise a host. Several other flaws score the maximum CVSS 10.0 and allow unauthenticated remote code execution. HPE credited its internal networking security researchers and said it knew of no public discussion or exploit code at release time. Even so, it urged rapid patching because of the breadth and potential impact.

    Technical Details

    • The bulletin spans authentication bypass, command and SQL injection, buffer overflow, memory corruption, path traversal, information disclosure, XSS, file manipulation and DoS.
    • Particularly concerning flaws affect the PAPI access-point management protocol. CVE-2026-79860 targets UDP port 8211 with crafted packets. Other PAPI flaws allow command injection, SQL injection, buffer overflow or authentication bypass.
    • Affected AOS-10 versions: 10.8.1.1 and earlier, 10.7.2.6 and earlier, 10.4.1.13 and earlier.
    • Affected AOS-8 versions: 8.13.3.0 and earlier, 8.10.0.23 and earlier.
    • Affected products include Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points and virtual deployments.

    Remediation

    • Upgrade to AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14, depending on the branch. AOS-8 users should move to 8.13.3.1 or 8.10.0.24.
    • If an immediate upgrade is not possible, isolate CLI and web-management interfaces on a dedicated Layer 2 segment or VLAN, enforce Layer 3 or higher firewall controls, and enable accounting to log user activity. These measures reduce exposure but do not replace patching.
    • Inventory physical and virtual instances and verify their versions. Review firewall and authentication logs for management access. Prioritize internet-reachable systems, and rotate credentials if compromise is suspected.
  4. bleepingcomputer.com ↗ · pub. 23/10/2026 09:48 · coletado 23/10 10:00 primeiro registro

    HPE patches 72 ArubaOS flaws, including eight max-severity auth bypass and RCE bugs in AOS-8 and AOS-10

    ler a análise desta fonte

    Hewlett Packard Enterprise (HPE) released updates for 72 vulnerabilities in ArubaOS (AOS), the operating system behind Aruba Networking wireless infrastructure such as mobility conductors, access points, controllers and gateways. Eight of the flaws are rated maximum severity and allow authentication bypass and code execution. They affect multiple AOS-8 and AOS-10 versions and can be exploited remotely, without privileges or user interaction, in low-complexity attacks. HPE says it has found no public proof-of-concept code and no evidence of exploitation in the wild. It urges customers to patch quickly because of the breadth and impact of the flaws.

    Technical Details

    • The eight maximum-severity issues are unauthenticated, remotely exploitable, low-complexity and need no user interaction.
    • The article does not list CVE identifiers; they are in a table in the HPE advisory.
    • HPE is not aware of public discussion or exploit code for the listed flaws as of the advisory release date.
    • Earlier HPE issues cited for context: critical StoreOnce flaws (June 2025), hardcoded credentials in Aruba Instant On access points (July 2025), a maximum-severity OneView flaw that CISA flagged as exploited (January 2025), and critical AOS-CX flaws allowing admin password resets and RCE.

    Remediation

    • Apply the HPE security updates for AOS-8 and AOS-10 as soon as possible.
    • Restrict the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN, and/or control them with firewall policies at layer 3 and above.
    • Enable accounting controls to track and log user activity and resource usage.