HPE Aruba Networking AOS-8 and AOS-10 Bulletin HPESBNW05162: CVE-2026

HPE published security bulletin HPESBNW05162 on 22 October 2026. It fixes 72 vulnerabilities in HPE Aruba Networking's wireless operating systems, AOS-8 and AOS-10, which run on Mobility Conductors, Mobility Controllers, Mobility Gateways and access points. HPE rates the bulletin Critical. The headline flaw, CVE-2026-79844, is an authentication bypass in AOS-10 that can lead to remote code execution. HPE scores it CVSS 3.1 10.0, the maximum, and says it could allow command execution "if certain preconditions outside of the attacker's control are met". HPE gives seven more CVEs the same 10.0 score: four in AOS-8, including CVE-2026-79846, which carries the same preconditions caveat, and three more in AOS-10. The fixed versions are AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14, and AOS-8.13.3.1 and 8.10.0.24, or later.

These are the controllers and gateways that run enterprise Wi-Fi, so the fix matters. The facts so far are calmer than the score. HPE says the flaws "were generally discovered by internal security research at HPE Networking". HPE says it "is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory". As of 23 October 2026, 16:40 Cyprus time (UTC+3), none of the 72 CVEs is in CISA's Known Exploited Vulnerabilities (KEV) catalog. HPE also published a workaround: keep the management interfaces off networks you do not trust. Patch now, and check which of your vendors run these systems.

Technical Information

What HPE has said ( HPESBNW05162 , revision 1, 22 October 2026; signed text copy ):

The bulletin covers "Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-8 and AOS-10) for Mobility Conductors, Controllers, Gateways, and Access Points."

The vulnerabilities "were generally discovered by internal security research at HPE Networking". In its per-CVE acknowledgements, HPE credits 20 CVEs (four of them jointly with its internal research) to participants in HPE Networking's Bug Bounty program, and one, CVE-2026-95705, to Michael Messner, Benedikt Kuehne and Caio Adler Goncalves Farias of Siemens Energy.

HPE is "not aware of any public discussion or exploit code" for these flaws as of the release date.

HPE writes: "Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities."

The eight CVEs HPE scores 10.0. All eight carry the same pattern in HPE's CVSS 3.1 vectors: reachable over the network (AV:N), low attack complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and a changed scope (S:C). HPE's own text adds one limit for two of them: CVE-2026-79844 and CVE-2026-79846 could allow command execution "if certain preconditions outside of the attacker's control are met". HPE does not say what those preconditions are.

PAPI is Aruba's access point management protocol. HPE says several of the flaws are in it, and names UDP port 8211 for PAPI.

The rest of the bulletin. HPE's signed text rates 33 of the 72 CVEs Critical (CVSS 9.0 or higher), 31 High, 7 Medium and 1 Low. Of those 33, the vectors in the signed text say 19 can be reached over the network. The other 14 need an attacker on an adjacent network, such as the same network segment. Many of the High-rated CVEs are also unauthenticated. Several others need an administrator account or local access. Most CVEs apply to one product line. A few, including CVE-2026-79852 (9.8, SQL injection in the web-based management interface), apply to both AOS-8 and AOS-10.

One score differs between HPE's documents. For CVE-2026-79881 (an AOS-8 authentication bypass), HPE's signed text and the CVE record give 8.5 (High). The score table on HPE's bulletin page and NVD give 8.3. HPE's machine-readable CSAF file scores it 9.6 (Critical), with a different vector. This post follows HPE's signed bulletin text, so its counts show 33 rated Critical.

One CVE ID points to an unrelated record. HPE lists CVE-2026-79845 for the AOS-10 PAPI authentication bypass. The public CVE record for this ID currently describes an unrelated product, so readers should use HPE's bulletin as the reference for this issue.

CVE and NVD status. HPE is the CNA for the other 71 CVE records. It published them on 22 October. The CVE record for CVE-2026-79844 has no description yet. It lists the affected ranges and HPE's 10.0 score; HPE's bulletin text qualifies this flaw with "certain preconditions outside of the attacker's control". CISA's SSVC assessment on the record (dated 22 October) records exploitation as "none", automatable as "yes" and technical impact as "total". NVD lists the CVE as "Received". It shows only HPE's score and has not published its own.

What is not known. HPE has not said which interfaces or services each flaw affects, beyond PAPI, the web-based management interface, the CLI and the SSH daemon where it names them. The bulletin does not say whether HPE applies these fixes to gateways managed by HPE Networking Central. HPE's Central online help describes firmware upgrades as a step the Central user starts under Maintain > Firmware, either now or at a scheduled time; it does not address this bulletin. Nor has it said what "certain preconditions" means for CVE-2026-79844.

Timeline (dates as published; Cyprus time, UTC+3, where a source gives a time):

15 October 2026: HPE publishes advance notice HPESBNW05159 . It says advisories for AOS-8 and AOS-10 will follow on 22 October and "will be larger than usual". It gives no details.

22 October: HPE publishes HPESBNW05162, revision 1, on its support portal. It also publishes a signed text copy and a CSAF file.

22 October, 22:04 to 22:07: HPE, as CNA, publishes 71 CVE records (19:04 to 19:07 UTC).

22 October, 22:17: CVE-2026-79844 appears in NVD (19:17 UTC).

22 October (date printed by CCCS): The Canadian Centre for Cyber Security publishes advisory AV26-1079 , which links HPESBNW05162 rev.1 and lists "Versions prior to" 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24. It "encourages users and administrators to review the provided web links and apply any necessary updates as they become available."

23 October, 13:35: Germany's BSI (CERT-Bund) publishes advisory WID-SEC-2026-4125 , which references HPESBNW05162 and lists all 72 CVEs. BSI rates it "hoch" (high) on its own scale.

23 October, 16:40: None of the 72 CVEs is in CISA's KEV catalog (version 2026.10.21). We found nothing this bulletin from CERT-EU, CERT-FR, the UK NCSC, JPCERT/CC, JVN or CISA.

Affected Product Versions

Per HPESBNW05162 (22 October 2026). HPE lists these products: Mobility Conductors, Mobility Controllers, Mobility Gateways (managed by HPE Networking Central), AOS-10 access points (AOS-AP) and AOS-8 Instant access points (AOS-IAP). HPE also says that any hardware, mobility device, access point or virtual machine that can run an affected version is vulnerable. Its hardware list is "for illustrative purposes only".

HPE's CSAF ranges also cover the 10.6, 10.3 and 8.12 branches. HPE lists no separate fixes for them, so plan to move those devices to one of the fixed releases above. Each CVE applies to AOS-8, AOS-10 or both, as noted in HPE's bulletin. HPE says other HPE Networking products are not affected.

Workaround and Mitigation

Upgrade. Move AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14, and AOS-8 to 8.13.3.1 or 8.10.0.24, or later. Do this on every conductor, controller, gateway and access point. HPE provides the fixed versions on the HPE Networking Support Portal .

Until you upgrade, restrict management access. HPE's workaround is to restrict the CLI and web-based management interfaces "to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage."

Keep PAPI and management off untrusted networks. Check that no management interface or PAPI traffic (UDP 8211, per HPE) is reachable from the internet or from guest and other untrusted segments (Rescana guidance) . Because 14 of the CVEs rated Critical in HPE's signed bulletin text need adjacent access, guest Wi-Fi and shared segments count as untrusted.

Move off End of Maintenance and End of Support releases. HPE treats them as presumed or potentially affected and does not cover them in this bulletin.

Check Central-managed gateways. If you use Mobility Gateways managed by HPE Networking Central, confirm with HPE or your provider which version they run and who applies the upgrade; HPE's Central documentation describes upgrades as user-initiated (Rescana guidance) .

Indicators of Compromise

HPE has published no indicators of compromise for HPESBNW05162, and none of the sources we checked report exploitation. HPE does not map these vulnerabilities to MITRE ATT&CK, and we have not done so either. As general hygiene, review the accounting and audit logs that HPE's workaround recommends. Look for unexpected administrator logins, configuration changes and new accounts on controllers and gateways (Rescana guidance) .

We will update this post if HPE revises HPESBNW05162 or says more the "certain preconditions" or Central-managed devices. We will also update it if the CVE-2026-79845 record or the CVE-2026-79881 scores change, or if exploitation or public exploit code is reported. Finally, we will update it if CISA adds any of these CVEs to the KEV catalog, or if NVD or another national CERT publishes its own assessment.

HPE, "HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)" (22 October 2026): ; advance notice HPESBNW05159 (15 October 2026):

HPE Networking, signed text copy of HPESBNW05162 (CVE list, scores, vectors, acknowledgements, affected and fixed versions): ; CSAF version:

HPE Aruba Networking Central online help, "Upgrading Devices":

BSI (CERT-Bund), WID-SEC-2026-4125, "Aruba ArubaOS: Mehrere Schwachstellen" (23 October 2026): ; Canadian Centre for Cyber Security, "HPE security advisory (AV26-1079)" (22 October 2026):

CVE Program, NVD and CISA

CVE Program records for CVE-2026-79844 (CNA: HPE; CISA-ADP SSVC) and CVE-2026-79845 (currently describes an unrelated product), checked 23 October 2026: and

NVD, CVE-2026-79844 (Received, HPE score only): ; CISA, Known Exploited Vulnerabilities catalog (checked 23 October 2026, 16:40 Cyprus time; version 2026.10.21; none of the 72 CVEs listed):

Why this matters for your vendors

MSPs, managed Wi-Fi providers, and retail, healthcare and campus operators commonly run Aruba controllers and gateways, so this bulletin may sit in your supply chain even if you do not run Aruba yourself. A short, friendly check with those vendors on whether they run AOS-8 or AOS-10, whether their management interfaces are reachable from untrusted networks, who applies upgrades to any Central-managed gateways, and when they will reach the fixed versions will tell you most of what you need.

Forward this to your TPRM owner (Rescana guidance) . Questions for vendors that run or manage wireless networks for you:

Do you run HPE Aruba Networking AOS-8 or AOS-10 on conductors, controllers, gateways or access points, including devices you manage for us?

Are all of them on AOS-10.8.1.2, 10.7.2.7 or 10.4.1.14, or AOS-8.13.3.1 or 8.10.0.24, or later? If not, when will they be?

Are the CLI, web-based management and PAPI reachable from the internet, guest networks or other untrusted segments?

Do any devices run End of Maintenance or End of Support releases, and what is the plan for them?

Are you logging administrator activity on these devices, as HPE recommends?

Want a fast, evidence-based view of which suppliers run network-edge platforms like these, and how quickly they patch? Book a demo .