High-Severity Flaws in HPE Aruba Networking Expose Mobility Controllers to Attack

On 15 January 2026, HPE Aruba Networking released a security advisory patching a batch of vulnerabilities across its AOS-8 and AOS-10 operating systems that affect Mobility Conductors, Controllers and Gateways. The most alarming flaw, CVE-2025-37168, carries a CVSS score of 8.2 and allows unauthenticated attackers to delete arbitrary files, potentially causing immediate denial of service by taking the device offline or destabilising it, according to the advisory.

The update also covers CVE-2025-37169, a stack overflow in the web management interface, and CVE-2025-37170/71/72, multiple command injection flaws, as well as CVE-2025-37174/75, file upload and write vulnerabilities that can enable code execution. Patches are available for AOS-10.7.x.x (10.7.2.2 or above), AOS-10.4.x.x (10.4.1.10 or above), AOS-8.13.x.x (8.13.1.1 or above) and AOS-8.10.x.x (8.10.0.21 or above).

The advisory also warns that many End of Maintenance versions such as AOS-10.6, AOS-8.12, AOS-8.11 and SD-WAN 8.7 are not patched, leaving those deployments exposed unless they move to a supported branch, according to the advisory. For those unable to patch immediately, HPE advises restricting access to the CLI and web interfaces to a dedicated VLAN or applying strict firewall policies as a temporary mitigation.