HPE released patches for 72 vulnerabilities, including 33 critical-severity flaws, in its AOS-8 and AOS-10 wireless operating systems for Aruba networking products.
The vulnerability or weakness
Eight max-severity bugs, including CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851, could allow unauthenticated attackers to achieve remote code execution and bypass authentication.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-79844 | 10.0 | CRITICAL | No | - |
| CVE-2026-79845 | n/a | not scored | No | - |
| CVE-2026-79846 | 10.0 | CRITICAL | No | - |
| CVE-2026-79847 | 10.0 | CRITICAL | No | - |
| CVE-2026-79848 | 10.0 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes (2026-10-26)
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud (2026-10-24)
- Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws (2026-10-23) - The Hacker News
- Atlassian Patches 75 Flaws in Data Center and Server Products (2026-10-23)
- Cisco Patches 34 Vulnerabilities Across Multiple Products (2026-10-22)
Business impact
Organizations could face operational disruptions and potential system compromise if these vulnerabilities are exploited, impacting operations and potentially incurring costs related to recovery efforts.
Industries affected
The incident affects industries that rely on Aruba networking products, including enterprise IT, telecommunications, and any organization with critical infrastructure.
Users affected
Customers using HPE Aruba networking products, particularly those running AOS versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2, are advised to apply the patches immediately to mitigate risks.
Build these skills
Sources
- HPE Patches Dozens of Critical Flaws in Networking Products (SecurityWeek)
