HPE has issued patches for 72 vulnerabilities affecting its HPE Networking AOS-8 and AOS-10 wireless operating systems, which run across Mobility Conductors, Controllers, Gateways and Access Points. The flaws span unauthenticated remote code execution, authentication bypasses, SQL injections and buffer overflows, with eight CVSS 3.0 scores reaching 10.0.
The most severe issues often leverage the PAPI protocol (Aruba’s access point management protocol) listening on UDP port 8211, enabling attackers to inject commands, overflow buffers or bypass logins. In practice, successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying OS. HPE notes that many flaws require little to no authentication and can be exposed over the network or from adjacent network access, such as a same Wi‑Fi or LAN segment.
The affected versions include AOS-10.8.0[.]0 through 10.8.1[.]1, 10.6.0[.]0 through 10.7.2[.]6, and 10.3.0[.]0 through 10.4.1[.]13, alongside AOS-8.12.0[.]0 through 8.13.3[.]0 and 8.10.0[.]0 through 8.10.0[.]23. The CVEs span CVE-2026-79844 to CVE-2026-79852, among others, with several CVSS 10.0 entries (e.g., CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851).
The advisory notes eight critical/remote-executable flaws in AOS-10 and AOS-8 tied to the PAPI protocol and related components. There is no public indication of exploitation in the wild at this time, and no CVE has appeared in CISA’s Known Exploited Vulnerabilities catalogue, though the volume and unauthenticated nature of these bugs make patching imperative.
Patches are available in the form of AOS-10.8.1[.]2, 10.7.2[.]7 or 10.4.1[.]14 for AOS-10, and AOS-8.13.3[.]1 or 8.10.0[.]24 for AOS-8. Organisations should move devices on older branches to supported fixed releases, limit PAPI traffic to trusted devices, and review logs for unexpected admin activity. Until patched, HPESBNW05162 recommends restricting CLI and web management interfaces to a dedicated layer 2 segment or controlled by firewall policies.