HPE Patches 72 Flaws in AOS-8 and AOS-10, Including Eight CVSS 10.0 Bugs

TL;DR

HPE has patched 72 HPE Networking AOS vulnerabilities in its AOS-8 and AOS-10 wireless operating systems. They affect Mobility Conductors, Controllers, Gateways and Access Points. Of these, 34 rate critical and eight carry the maximum CVSS score of 10.0. Admins should upgrade to AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1 or 8.10.0.24.

Notable CVEs

CVE	CVSS (CVSSv3)	Type	Status
CVE-2026-79844	10	CWE-288	Not exploited
CVE-2026-79846	10	Unauthenticated Command Injection in AOS-8	Not exploited
CVE-2026-79847	10	CWE-119	Not exploited
CVE-2026-79848	10	CWE-89	Not exploited
CVE-2026-79849	10	CWE-89	Not exploited
CVE-2026-79850	10	CWE-288	Not exploited
CVE-2026-79851	10	CWE-119	Not exploited
CVE-2026-79852	9.8	CWE-89	Not exploited

Why It Matters

AOS-8 and AOS-10, formerly sold under the Aruba brand, run enterprise Wi-Fi in offices, campuses and hospitals. Controllers and gateways sit in the path of user traffic. As a result, a takeover could let an attacker watch or redirect that traffic.

The scale of this release stands out. According to the CVSS data, 58 of the 72 flaws need no login at all. Of those, 32 are reachable over the network. Another 25 need an attacker on an adjacent network, such as the same Wi-Fi or LAN segment. The last one requires physical access.

A patch release, not a breach report

The HPE Networking security advisory HPESBNW05162 describes the update plainly. HPE “has released patches for the HPE Networking Wireless Operating Systems (AOS-8 and AOS-10)… that address multiple security vulnerabilities.” HPE Networking found most of the flaws itself. Bugcrowd researchers, including moonv, LIUPENG and zzcentury, reported others. Diego Gomez and David Kierznowski shared credit on three flaws, and a Siemens Energy team found one more.

How the Attacks Work

The 72 HPE Networking AOS vulnerabilities fall into a few familiar groups. Most lead to code execution as a privileged user on the device.

Severity at a glance

• Critical: 32 flaws, eight of them at CVSS 10.0
• High: 31 flaws
• Medium: 8 flaws
• Low: 1 flaw

Most of the high and critical issues share the same outcome. HPE repeatedly warns that success lets an attacker “execute arbitrary code as a privileged user on the underlying operating system.”

The CVSS 10.0 flaws

• CVE-2026-79844 (AOS-10): an authentication bypass that lets an unauthenticated attacker “run arbitrary commands on the underlying host if certain preconditions outside of the attacker’s control are met.”
• CVE-2026-79845 (AOS-10): flaws in the PAPI protocol that let attackers “circumvent existing authentication controls” and gain admin access.
• CVE-2026-79846 (AOS-8): command injection leading to commands on the host.
• CVE-2026-79847 and CVE-2026-79851 (AOS-10): buffer overflows that enable unauthenticated remote code execution.
• CVE-2026-79848 and CVE-2026-79849 (AOS-8): SQL injection that can end in command execution.
• CVE-2026-79850 (AOS-8): an authentication bypass that runs commands “as root on the underlying operating system.”

PAPI is a recurring target

Many bugs sit in PAPI, which HPE calls “Aruba’s access point management protocol.” It listens on UDP port 8211. Several flaws let attackers send “specially crafted PAPI packets” to inject commands, overflow buffers or bypass logins.

For example, CVE-2026-79857 is a command injection in the PAPI protocol of AOS-8. HPE says it allows remote code execution “by sending specially crafted packets to the affected UDP port.” Similarly, CVE-2026-79861 brings the same type of bug to AOS-10. Other PAPI protocol flaws allow SQL injection, file writes and path traversal.

Adjacent attackers matter too

Many critical bugs rate CVSS 9.6 because they require adjacent network access. In practice, that means an attacker on the same local network or wireless segment. For a Wi-Fi platform, that bar is lower than it sounds. Guest networks and shared office spaces can put strangers within reach of access points.

Other weaknesses

The remaining bugs cover a wide range. They include an SSH daemon authentication bypass (CVE-2026-79855), path traversal and information leaks. Server-side request forgery and denial of service bugs also appear. In addition, one AOS-10 flaw leaks data through Wi-Fi frame processing. A stored XSS bug and several admin-only issues round out the list.

Some lower-rated bugs still carry real weight. For instance, two admin-level flaws can crash a device so that it cannot reboot “without manual intervention.” In a large Wi-Fi deployment, that could mean a site visit for each affected unit.

Exploitation status

HPE does not report exploitation in the wild for any of these flaws. No public proof-of-concept has been confirmed, and none of the 72 CVEs appears in CISA’s Known Exploited Vulnerabilities catalog. Even so, the sheer number of unauthenticated bugs makes a quick upgrade wise.

Affected Versions

• AOS-10.8.0.0 through 10.8.1.1
• AOS-10.6.0.0 through 10.7.2.6
• AOS-10.3.0.0 through 10.4.1.13
• AOS-8.12.0.0 through 8.13.3.0
• AOS-8.10.0.0 through 8.10.0.23

Patch and Mitigation Steps

• Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14.
• Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24.
• Move devices on other branches to a supported, fixed release.
• Limit access to PAPI traffic on UDP port 8211 to trusted devices.
• Review logs for unexpected admin logins or configuration changes.

Until you can patch, HPE recommends that “the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies.” HPE also advises logging user activity. However, these steps only reduce risk. With dozens of unauthenticated bugs in play, patching these HPE Networking AOS vulnerabilities should be a top priority.