HPE patches 72 flaws across Aruba networking products

HPE has released patches addressing 72 vulnerabilities across its Aruba networking products, including a batch of eight maximum-severity flaws that could enable unauthenticated remote code execution, authentication bypass, and other system compromises. The eight max-severity CVEs are CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850 and CVE-2026-79851.

Exploitation of these defects could allow unauthenticated attackers to execute arbitrary commands, gain administrative privileges, or otherwise fully compromise affected devices. HPE notes that all hardware, mobility solutions (including conductors, controllers and gateways), access points, and virtual machines compatible with the vulnerable Aruba Wireless OS versions are affected.

fixes cover Aruba AOS versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2, applying across mobility conductor, controller, gateway and access point products. In addition to the eight max-severity issues, HPE resolved 31 high-severity vulnerabilities across its networking portfolio, including more than a dozen that could be exploited without authentication, along with eight medium-severity flaws and one low-severity weakness.

The advisory states that the patches mitigate risks such as unauthenticated RCE, command execution, information disclosure, authentication bypass, file tampering and complete system compromise. HPE also urges restricting CLI and web-based management interfaces to a dedicated layer 2 segment or via firewall policies, while maintaining accounting logs. The company says it is not aware of any of these vulnerabilities being exploited in the wild, but advises customers to apply the updates promptly.