HPE Addresses Dozens of Critical Security Vulnerabilities in Aruba Networking Products
HPE has announced the release of an urgent security update package to address 72 security vulnerabilities in the wireless networking operating systems of Aruba products, specifically in the AOS-8 and AOS-10 operating systems. These updates include fixes for 33 vulnerabilities classified as "critical," in addition to eight vulnerabilities described as "max-severity."
Nature of the Security Risks
The most dangerous vulnerabilities center around a set of identifiers (from CVE-2026-79844 to CVE-2026-79851), which could allow unauthorized attackers to execute remote code (RCE) and bypass authentication processes to gain full administrative privileges. This type of vulnerability allows an attacker to run arbitrary commands, which could lead to the compromise of affected systems and full control over them.
In addition to the eight major vulnerabilities, the updates included fixes for 31 other "high" severity vulnerabilities, 8 "medium" severity vulnerabilities, and one "low" severity vulnerability. The risks of these vulnerabilities vary between the exposure of sensitive information, file manipulation, and unauthorized access to system administration.
Affected Systems and Products
HPE has made the fixes available in the following versions of AOS systems:
- AOS-8: Versions 8.10.0.24 and 8.13.3.1
- AOS-10: Versions 10.4.1.14, 10.7.2.7, and 10.8.1.2
The impact includes all devices and solutions compatible with these systems, including controllers, gateways, access points, and virtual machines (VMs) running these systems.
What Must Be Done to Secure the Network?
Although HPE confirmed that no exploitation of these vulnerabilities has been observed in the wild to date, it urged customers to apply the updates immediately. To reduce the likelihood of a successful attack, the company recommended following these practices:
- Management Isolation: Restrict management interfaces, whether via command-line interface (CLI) or web interface, to a dedicated network segment (Dedicated VLAN/Layer 2 segment).
- Firewall Control: Use Layer 3 and above firewall policies to control access.
- Monitoring and Tracking: Enable accounting controls to track and log all user activities and resource usage within the network.