Rescana

Critical Vulnerabilities Found in HPE AOS-8 and AOS-10 Wireless Systems

First seen 23 Oct 2026, 14:07 UTC • •70.5

Article Content

1 / 5

Browse articles

ThreatCluster •October 23, 2026 at 15:14 UTC

•HPE has released patches for 72 vulnerabilities in AOS-8 and AOS-10 systems.
•CVE-2026-79844 is a critical authentication bypass flaw with a CVSS score of 10.0.
•HPE advises immediate patching and restricting management interfaces to trusted networks.

Hewlett Packard Enterprise (HPE) has issued a security bulletin addressing 72 vulnerabilities in its AOS-8 and AOS-10 wireless operating systems, which are used in Mobility Conductors, Controllers, Gateways, and Access Points. The most severe flaw, CVE-2026-79844, is an authentication bypass in AOS-10 that can lead to remote code execution, rated CVSS 10.0. Other critical vulnerabilities include CVE-2026-79846, which also has a CVSS score of 10.0. HPE recommends that users patch their systems immediately, as the vulnerabilities could allow unauthorized command execution under specific conditions. As of now, HPE is not aware of any public exploits targeting these vulnerabilities. The patched versions are AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, and AOS-8.13.3.1, 8.10.0.24 or later. Security professionals are advised to restrict management interfaces to trusted networks to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-08-25

CVE-2026-79845 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

HPE security bulletin published

HPE released bulletin HPESBNW05162 addressing 72 vulnerabilities in AOS-8 and AOS-10 systems, including critical flaws.

Rescana

2026-10-22

Critical CVEs disclosed

CVE-2026-79844 and CVE-2026-79846 were disclosed with a CVSS score of 10.0, indicating severe risk.

Support.Hpe

2026-10-22

CVE-2026-79844 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

CVE-2026-79846 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

CVE-2026-79881 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

CVE-2026-79852 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

CVE-2026-95705 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

CVE-2026-79847 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

2026-10-22

CVE-2026-79848 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

MITRE

Following this threat?

Track CVE-2026-79844 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which versions of AOS are affected?

AOS-10 versions 10.8.1.1 and below, 10.7.2.6 and below, and 10.4.1.13 and below, as well as AOS-8 versions 8.13.3.0 and below, and 8.10.0.23 and below.

What should I do if I use these systems?

You should apply the latest patches (AOS-10.8.1.2, 10.7.2.7, 10.4.1.14, AOS-8.13.3.1, and 8.10.0.24 or later) immediately.

Is there any known exploitation of these vulnerabilities?

As of now, HPE reports no known public exploits targeting these vulnerabilities.