# HPE Aruba AOS patches 72 flaws, 8 critical RCEs

Published: 2026-10-26 · Severity: routine
Canonical: https://vorant.io/reports/e03d824d-84c1-5e99-9d0f-86db7e91f4ab/hpe-aruba-aos-patches-72-flaws-8-critical-rces

> HPE patched 72 vulnerabilities in Aruba AOS-8/AOS-10 networking gear, including eight unauthenticated critical RCEs rated CVSS 10.0; no known exploitation yet.

NCSC-NL issued an advisory summarizing HPE's patches for 72 vulnerabilities affecting HPE Networking AOS-8 and AOS-10, covering Mobility Conductors, Mobility Controllers, Mobility Gateways and Access Points. The flaws span authentication bypass, command injection, SQL injection, code injection, buffer overflows and missing/incorrect access control. Of the 72 issues, 33 are rated critical; 19 can reportedly be exploited remotely without authentication over the network, while the remaining 14 critical issues also require no authentication but need access to an adjacent network segment. Successful exploitation can result in arbitrary code execution, administrative takeover, configuration tampering, disclosure of sensitive data, or denial of service.

Eight CVEs (CVE-2026-79844, -79845, -79846, -79847, -79848, -79849, -79850, -79851) carry CVSS 10.0 and can be exploited remotely without authentication or user interaction; seven of these lead to arbitrary code execution, while CVE-2026-79845 can expose or allow modification of sensitive data and grant administrative access. HPE notes that exploitation of CVE-2026-79844 and CVE-2026-79846, despite their 10.0 scores, may depend on conditions outside attacker control. Two additional vulnerabilities, CVE-2026-79857 and CVE-2026-79860, affect the PAPI protocol in AOS-8 and can be triggered remotely via specially crafted UDP packets, potentially leading to code execution with elevated privileges and full system compromise.

HPE states it is not aware of public exploit code or confirmed active exploitation at this time. NCSC-NL advises prioritizing the critical patches: upgrade to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1, 8.10.0.24, or later supported releases, and additionally isolate CLI and web management interfaces behind a dedicated VLAN and/or firewall rules as a compensating control.

## Mentioned in this report

- Vulnerabilities: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851, CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, CVE-2026-79861, CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, CVE-2026-79871, CVE-2026-79872, CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, CVE-2026-79876, CVE-2026-79877, CVE-2026-79878, CVE-2026-79879, CVE-2026-79880, CVE-2026-79881, CVE-2026-79882, CVE-2026-79883

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0454.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e03d824d-84c1-5e99-9d0f-86db7e91f4ab/hpe-aruba-aos-patches-72-flaws-8-critical-rces.
In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup