HPE's security bulletin HPESBNW05162 rev.1, released 22 October 2026, lists 72 CVEs in the HPE Networking Wireless Operating Systems AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways and Access Points. HPE rates eight of them 10.0 under CVSS 3.1: CVE-2026-79844 and CVE-2026-79850 (authentication bypass leading to remote code execution in AOS-10 and AOS-8), CVE-2026-79845 (authentication bypass in the PAPI protocol of AOS-10 allowing unauthorised access and modification of sensitive data), CVE-2026-79846 (unauthenticated command injection in AOS-8), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection allowing remote code execution in AOS-8), and CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows leading to remote code execution in AOS-10).

A further 25 are rated between 9.0 and 9.8, among them unauthenticated command and SQL injection in the PAPI protocol and an authentication bypass in the AOS-8 SSH daemon. HPE lists affected versions as AOS-10.8.x.x: 10.8.1.1 and below, AOS-10.7.x.x: 10.7.2.6 and below, AOS-10.4.x.x: 10.4.1.13 and below, AOS-8.13.x.x: 8.13.3.0 and below and AOS-8.10.x.x: 8.10.0.23 and below. It recommends upgrading to AOS-10.8.x.x: 10.8.1.2 and above, AOS-10.7.x.x: 10.7.2.7 and above, AOS-10.4.x.x: 10.4.1.14 and above, AOS-8.13.x.x: 8.13.3.1 and above or AOS-8.10.x.x: 8.10.0.24 and above.

HPE says versions that have reached End of Maintenance are presumed to be affected and are not covered by the advisory. HPE says the vulnerabilities were generally discovered by its internal security research and that it 'is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory'. It adds: 'Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities.'

Until patches are applied, HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with firewall policies at layer 3 and above.

HPE published CVE records citing the bulletin on 22 October (UTC), and CISA's ADP enrichment on the seven 10.0-rated HPE records lists exploitation as none. When checked on 23 October, the CVE list entry for CVE-2026-79845 was an unrelated record assigned by VulDB, not an HPE record.

Primary: HPE security bulletin; vendor: HPE CVE records. Updated 23 Oct 2026: BleepingComputer reported the bulletin, noting that ArubaOS powers Aruba Networking enterprise wireless infrastructure. (source: BleepingComputer)