# HPE Aruba Patches Dozens of AOS Flaws

Published: 2026-10-23 · Severity: severe · Sectors: Technology, Telecommunications
Canonical: https://vorant.io/reports/e778b713-0db0-5675-8297-5f46a921b278/hpe-aruba-patches-dozens-of-aos-flaws

> CERT-FR warns of over 90 vulnerabilities in HPE Aruba Networking AOS and ClearPass Policy Manager, including remote code execution and privilege escalation flaws.

CERT-FR has issued an advisory covering multiple vulnerabilities disclosed by HPE in its Aruba Networking product line, affecting AOS (versions 8.10.x, 8.13.x, 10.4.x, 10.7.x and 10.8.x prior to specified patched builds) and ClearPass Policy Manager (6.11.x and 6.14.x prior to patched versions). The vulnerabilities span a broad range of impact categories including remote code execution, privilege escalation, remote denial of service, SQL injection, server-side request forgery, cross-site scripting, data integrity and confidentiality breaches, and security policy bypass.

The advisory references two HPE security bulletins (HPESBNW05162 and HPESBNW05171, both dated 22 October 2026) and enumerates roughly 90 individual CVEs. No specific exploitation details, proof-of-concept availability, or in-the-wild exploitation is mentioned in the advisory. HPE Aruba Networking equipment (wireless controllers, switches running AOS, and ClearPass network access control) is widely deployed in enterprise and campus network environments, making timely patching important given the mix of remote code execution and privilege escalation vulnerabilities among the set.

Defenders running affected AOS or ClearPass Policy Manager versions should consult the referenced HPE security bulletins and apply vendor patches to the fixed versions (AOS 10.4.1.14+, 10.7.2.7+, 10.8.1.2+, 8.10.0.24+, 8.13.3.1+; ClearPass Policy Manager 6.11.16+ and 6.14.1+) as soon as operationally feasible, prioritizing devices exposed to untrusted networks or management interfaces.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (templated), CVE-2026-109619, CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851, CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, CVE-2026-79861, CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, CVE-2026-79871, CVE-2026-79872, CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, CVE-2026-79876, CVE-2026-79877, CVE-2026-79878, CVE-2026-79879, CVE-2026-79880, CVE-2026-79881

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1369

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e778b713-0db0-5675-8297-5f46a921b278/hpe-aruba-patches-dozens-of-aos-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup