HPE Aruba AOS patches 72 flaws, 8 critical RCEs
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
HPE patched 72 vulnerabilities in Aruba AOS-8/AOS-10 networking gear, including eight unauthenticated critical RCEs rated CVSS 10.0; no known exploitation yet.
NCSC-NL issued an advisory summarizing HPE's patches for 72 vulnerabilities affecting HPE Networking AOS-8 and AOS-10, covering Mobility Conductors, Mobility Controllers, Mobility Gateways and Access Points. The flaws span authentication bypass, command injection, SQL injection, code injection, buffer overflows and missing/incorrect access control. Of the 72 issues, 33 are rated critical; 19 can reportedly be exploited remotely without authentication over the network, while the remaining 14 critical issues also require no authentication but need access to an adjacent network segment. Successful exploitation can result in arbitrary code execution, administrative takeover, configuration tampering, disclosure of sensitive data, or denial of service.
Eight CVEs (CVE-2026-79844, -79845, -79846, -79847, -79848, -79849, -79850, -79851) carry CVSS 10.0 and can be exploited remotely without authentication or user interaction; seven of these lead to arbitrary code execution, while CVE-2026-79845 can expose or allow modification of sensitive data and grant administrative access. HPE notes that exploitation of CVE-2026-79844 and CVE-2026-79846, despite their 10.0 scores, may depend on conditions outside attacker control. Two additional vulnerabilities, CVE-2026-79857 and CVE-2026-79860, affect the PAPI protocol in AOS-8 and can be triggered remotely via specially crafted UDP packets, potentially leading to code execution with elevated privileges and full system compromise.
HPE states it is not aware of public exploit code or confirmed active exploitation at this time. NCSC-NL advises prioritizing the critical patches: upgrade to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1, 8.10.0.24, or later supported releases, and additionally isolate CLI and web management interfaces behind a dedicated VLAN and/or firewall rules as a compensating control.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0454.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,193 reports from 143 sources, 552 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs