HPE Aruba Patches Dozens of AOS Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR warns of over 90 vulnerabilities in HPE Aruba Networking AOS and ClearPass Policy Manager, including remote code execution and privilege escalation flaws.
CERT-FR has issued an advisory covering multiple vulnerabilities disclosed by HPE in its Aruba Networking product line, affecting AOS (versions 8.10.x, 8.13.x, 10.4.x, 10.7.x and 10.8.x prior to specified patched builds) and ClearPass Policy Manager (6.11.x and 6.14.x prior to patched versions). The vulnerabilities span a broad range of impact categories including remote code execution, privilege escalation, remote denial of service, SQL injection, server-side request forgery, cross-site scripting, data integrity and confidentiality breaches, and security policy bypass.
The advisory references two HPE security bulletins (HPESBNW05162 and HPESBNW05171, both dated 22 October 2026) and enumerates roughly 90 individual CVEs. No specific exploitation details, proof-of-concept availability, or in-the-wild exploitation is mentioned in the advisory. HPE Aruba Networking equipment (wireless controllers, switches running AOS, and ClearPass network access control) is widely deployed in enterprise and campus network environments, making timely patching important given the mix of remote code execution and privilege escalation vulnerabilities among the set.
Defenders running affected AOS or ClearPass Policy Manager versions should consult the referenced HPE security bulletins and apply vendor patches to the fixed versions (AOS 10.4.1.14+, 10.7.2.7+, 10.8.1.2+, 8.10.0.24+, 8.13.3.1+; ClearPass Policy Manager 6.11.16+ and 6.14.1+) as soon as operationally feasible, prioritizing devices exposed to untrusted networks or management interfaces.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1369
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,237 reports from 143 sources, 591 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs