CERT-FR flags multiple Aruba Instant On flaws
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory covers 17 vulnerabilities in HPE Aruba Networking Instant On before 3.4.2.0, including RCE, privilege escalation, and DoS risks.
CERT-FR published an advisory summarizing multiple vulnerabilities disclosed by HPE in its Aruba Networking Instant On product line, affecting all versions prior to 3.4.2.0. The vulnerabilities collectively enable a range of impacts including remote arbitrary code execution, privilege escalation, remote denial of service, server-side request forgery (SSRF), security policy bypass, and confidentiality breaches. No indication is given that these vulnerabilities are being exploited in the wild.
The advisory references HPE's own security bulletin (HPESBNW05150, published 29 September 2026) and lists 17 associated CVE identifiers without individual technical descriptions, as is typical for CERT-FR bulletins that point to vendor advisories for remediation details. Defenders running Instant On network infrastructure should treat this as a standard patch-management advisory: identify all Instant On deployments, confirm firmware version, and apply the vendor patch bringing systems to 3.4.2.0 or later. Given the range of impacts, particularly RCE and privilege escalation on network access infrastructure, prompt patching is recommended even absent evidence of active exploitation.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1238
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 11,423 reports from 154 sources, 2,072 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs