HPE patches eight max severity RCE and auth bypass AOS flaws

Hewlett Packard Enterprise has rolled out fixes for 72 vulnerabilities in ArubaOS, the software that runs Aruba Networking's wireless gear, mobility conductors, access points, controllers and gateways. Eight of these bugs received the maximum severity rating, spanning both AOS-8 and AOS-10 branches, and include authentication bypass issues, command injection, SQL injection and buffer overflows that can all lead to remote code execution — reachable by unauthenticated attackers over the network with little effort and no user interaction. The affected CVE IDs are CVE-2026-79844 through CVE-2026-79851. HPE says it has no indication yet that exploit code or active attacks exist, but it is urging customers to apply patches immediately and, in the meantime, to lock down management interfaces behind VLAN segmentation and firewall rules with proper activity logging.