HPE ArubaOS Maximum-Severity Authentication Bypass and Code Execution Flaws (CVE-2026-79844)

HPE found most of these flaws itself, in internal research. The bulletin lists 72 CVEs. HPE labels 33 of them Critical, 31 High, 7 Medium and 1 Low. The page is named after CVE-2026-79844 because it is the first of the eight rated 10.0, and the other seven are listed below.

The Eight Flaws Rated 10.0

All eight need no login and no user action, and all eight can be reached over the network. HPE sets the scope to changed, which means a hit on the device can reach beyond it. Each one lets an attacker run commands or code on the underlying operating system, or take over administration.

• CVE-2026-79844: authentication bypass leading to remote code execution in AOS-10. HPE says certain preconditions outside the attacker's control must be met.
• CVE-2026-79845 (as HPE lists it, see the note below): authentication bypass in the PAPI protocol of AOS-10, giving administrative access and the power to change settings.
• CVE-2026-79846: unauthenticated command injection in AOS-8, with the same precondition wording as CVE-2026-79844.
• CVE-2026-79847: unauthenticated buffer overflow in AOS-10, reached with specially crafted packets, leading to code execution as a privileged user.
• CVE-2026-79848 and CVE-2026-79849: unauthenticated SQL injection in AOS-8 that leads to command execution on the operating system.
• CVE-2026-79850: authentication bypass in AOS-8 that lets an attacker run commands as root.
• CVE-2026-79851: unauthenticated buffer overflow in AOS-10 that leads to full system compromise.

CVE-2026-79848 and CVE-2026-79849 share one HPE entry, so the list shows seven entries for eight ids. Each entry also bundles two or more internal findings. The entry for CVE-2026-79851 alone lists 11 internal references.

One id does not match the CVE record. HPE gives the PAPI flaw the id CVE-2026-79845. The CVE record with that id, published by VulDB on 25 August 2026, describes a SQL injection in code-projects Simple Inventory System 1.0 instead. Until HPE or the CVE program corrects this, use the bulletin number HPESBNW05162 to track the PAPI flaw.

What Else Is in the Bulletin

Below the top eight, the bulletin lists 25 more flaws with scores from 9.3 to 9.8, and dozens with lower scores. They cover the web management interface, the command line, the SSH service, the API and PAPI, the protocol Aruba uses to manage access points over UDP port 8211. Some need an attacker on the same network segment, which HPE calls adjacent. Others need a login, and a few can only crash the device. The full table is in the HPE bulletin, and CVE ids run from CVE-2026-79844 to CVE-2026-79895, then CVE-2026-79955 and CVE-2026-79956, then CVE-2026-95704 to CVE-2026-95721.

Why Management Access Matters

HPE's own workaround is to keep the command line and web management interfaces on a dedicated layer 2 segment or VLAN, which is a kind of network segmentation. It also allows firewall rules at layer 3 and above, with accounting turned on.

That tells us where the risk sits. A controller or conductor whose management ports face the internet is exposed to attacks that need no login. A device that only answers on a closed management network is much harder to reach. We did not test whether any device is reachable from the internet, so we make no claim about how many are.

What Our Checks Showed

HPE writes that it is not aware of any public discussion or exploit code that targets these flaws as of the release date. The CISA Known Exploited Vulnerabilities (KEV) catalog file we read, released on 21 October, does not list any of the CVEs.

X: from 21 to 23 October we found 2 posts that mention the CVE or the AOS-10 fixes. Both repeat the bulletin. One account that posts security news lists the first three CVE ids and one small account says no known exploit exists yet.

Dark web monitoring through THANOS, 16 to 23 October: 3 posts mention ArubaOS and 1 mentions CVE-2026-79844, all on 23 October. They are news reposts, one on a Russian-language forum and the rest on Telegram channels, plus an automated CVE feed. These counts are not verified, and the fixes only became public on 22 October, so the picture can change quickly.

Our reading: eight unauthenticated flaws rated 10.0 in network gear are the kind attackers study quickly once patches can be compared. Treat this as a patch now bulletin.

HPE lists these products as affected:

• Mobility Conductors and Mobility Controllers.
• Mobility Gateways managed by HPE Networking Central.
• AOS-10 access points (AOS-AP).
• AOS-8 Instant access points (AOS-IAP).

Affected software versions, exactly as HPE writes them:

• AOS-10.8.x.x: 10.8.1.1 and below.
• AOS-10.7.x.x: 10.7.2.6 and below.
• AOS-10.4.x.x: 10.4.1.13 and below.
• AOS-8.13.x.x: 8.13.3.0 and below.
• AOS-8.10.x.x: 8.10.0.23 and below.

HPE adds that any hardware, Mobility solution, access point or virtual machine that is compatible with an affected version is vulnerable. Its hardware list is for illustration only and is not complete. Other HPE Networking products and versions not listed are not affected.

Fixed Versions

• AOS-10.8.x.x: 10.8.1.2 and above.
• AOS-10.7.x.x: 10.7.2.7 and above.
• AOS-10.4.x.x: 10.4.1.14 and above.
• AOS-8.13.x.x: 8.13.3.1 and above.
• AOS-8.10.x.x: 8.10.0.24 and above.

HPE says the fixed software is on the HPE Networking Support Portal.

Versions Past End of Support

HPE states that software past End of Maintenance is presumed affected and is not covered by the bulletin. For versions past End of Support, HPE has not assessed exposure, so such installations should be considered potentially impacted. HPE urges customers to move to a supported release.