HPE has published a security bulletin covering 72 vulnerabilities in ArubaOS, the operating system behind its wireless controllers, gateways and access points. Eight of those fixes are rated maximum severity, and all eight can be reached over the network without an account.
What happened
The eight maximum-severity flaws affect both AOS-8 and AOS-10 across multiple software versions. They cover authentication bypass leading to code execution, an authentication bypass in the PAPI protocol, unauthenticated command injection, unauthenticated SQL injection that reaches code execution, and unauthenticated buffer overflows leading to code execution.
Three of the records published for this bulletin score 10.0 under CVSS 3.1 with the vector AV:N/AC:L/PR:N/UI:N, meaning network reachable, low complexity, no privileges and no user interaction: CVE-2026-79844, CVE-2026-79846 and CVE-2026-79850. HPE states it is not aware of public exploit code or of exploitation in the wild as of the advisory release date.
Who is affected
Any environment running Aruba mobility conductors, controllers, gateways or access points on AOS-8 or AOS-10 that has not moved to the fixed build named in the HPE bulletin for its platform.
- Campus, hospitality, healthcare and education wireless estates where controllers are managed from a flat network.
- Sites that expose the web or CLI management interface to the internet, or to the same VLAN as staff and guest clients.
- Estates where the wireless controller was installed once and never included in the patch cycle.
What to do now
Patch the controllers and gateways first. Until that is done, restrict the management plane to a dedicated management VLAN and block it at the firewall.
- Identify every AOS-8 and AOS-10 device, including standalone controllers that sit outside your usual server patching scope.
- Apply the fixed release listed in HPE bulletin HPESBNW05162 for each device family, and record the build number.
- Move the web and CLI management interfaces onto a dedicated Layer 2 segment, or control access with firewall policy at Layer 3 and above.
- Confirm no management interface answers from the public internet, then review admin accounts and session logs on the controllers.
What this means for South African businesses
Wireless controllers are the least-patched internet-adjacent devices in most local mid-market networks, because they are treated as building infrastructure rather than IT. A CVSS 10.0 authentication bypass on that device hands an attacker the management plane for the whole wireless estate, which is often the same Layer 2 domain as staff laptops. The realistic risk this week is low, since nobody is exploiting these yet, but the exposure is real and the window is now, before a proof of concept appears.
Source: BleepingComputer, HPE patches eight max severity RCE and auth bypass AOS flaws.