PolicyCortex
Request Access
Summary
  • HPE published advisory HPESBNW05162 on October 22, 2026, covering 72 flaws in ArubaOS 8 and 10.
  • HPE rates eight flaws at CVSS 3.1 10.0. Seven resolve to HPE records. One ID currently resolves to another product.
  • The worst flaws give an unauthenticated attacker privileged code execution on controllers, gateways, and access points.
  • Fixed builds are AOS-10 10.8.1.2, 10.7.2.7, and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24.
  • HPE reports no known public exploit code and no known exploitation in the wild as of the advisory date.

A wireless patch with eight perfect scores

HPE Networking published security advisory HPESBNW05162 on October 22, 2026. It covers the wireless operating systems AOS-8 and AOS-10. The advisory fixes 72 flaws in total. HPE rates eight of them at a perfect 10.0. Seven of those IDs resolve to HPE records. The eighth needs a note, covered below.

A perfect score is rare. One is a warning. Eight at once is a patch window, not a patch someday.

The eight listed 10.0 flaws

Every flaw below needs network access only. No login is needed. No user must click anything.

The AOS-10 flaws:

  • CVE-2026-79844 is an authentication bypass. It lets an unauthenticated attacker run arbitrary commands on the host. HPE notes certain preconditions outside the attacker's control must also be met.
  • CVE-2026-79845 is a bypass in PAPI, the Aruba control protocol. HPE lists it at 10.0. Its public CVE record currently points to another product, so this article links it to the HPE advisory instead. See the note below.
  • CVE-2026-79847 and CVE-2026-79851 are buffer overflows. Each allows unauthenticated remote code execution.

The AOS-8 flaws:

  • CVE-2026-79846 is a command injection. It lets an unauthenticated attacker run commands on the host. HPE notes certain preconditions outside the attacker's control must also be met.
  • CVE-2026-79848 and CVE-2026-79849 are SQL injections. Each can end in command execution.
  • CVE-2026-79850 is an authentication bypass. It runs commands as root on the host.

Common Vulnerabilities and Exposures (CVE) is the public record system. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10. A 10.0 means the worst mix: network reach, low complexity, no login, no user action, full impact.

One ID does not check out

HPE lists CVE-2026-79845 at 10.0 for the PAPI flaw. The public CVE record for that ID names a different product. It describes a SQL injection in Simple Inventory System. It scores 7.3, not 10.0. That looks like an ID collision. Do not treat that inventory flaw as an HPE flaw. The PAPI flaw itself comes from HPE's advisory, not from the public record. Until the record is fixed, count seven verified 10.0 IDs, not eight.

Which builds are affected

AOS-10 builds at or below 10.8.1.1, 10.7.2.6, and 10.4.1.13 are affected. AOS-8 builds at or below 8.13.3.0 and 8.10.0.23 are affected. End of maintenance releases should be treated as affected too.

The fixed builds are AOS-10 10.8.1.2, 10.7.2.7, and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24. Upgrade to those builds or later.

What HPE says about exploitation

HPE stated on October 22, 2026 that it knew of no public exploit code. It also knew of no exploitation in the wild. That statement covers the advisory date. The CISA Known Exploited Vulnerabilities (KEV) catalog does not list any of the eight as of October 25, 2026.

That is good news with a short shelf life. A bulletin this detailed hands researchers a map. Patch while the window is still open.

What to do this week

First, list every Aruba controller, gateway, and access point you run. Record the build on each one. Second, upgrade affected builds to the fixed builds above. Third, re-scan and keep the dated result. Until the upgrade lands, restrict management interfaces to a dedicated management network segment. Log admin activity on every device.

The governance lesson

Wireless gear is infrastructure, not furniture. Controllers hold Wi-Fi keys, network config, and client data. A flaw in a controller is a flaw in the network boundary itself.

Most teams track servers and laptops closely. Network boxes get less attention. They sit in closets and ceilings for years. This bulletin is the reminder to inventory them like any other system.

Your evidence file for this bulletin should hold five items. The device inventory with builds. The advisory reference. The upgrade date per device. The re-scan result. The management network restriction, if you used it. An assessor can follow that file without asking twice.

Sources

Next step

Want patch evidence linked to each control, without chasing spreadsheets? See how PolicyCortex collects it from live systems.

Questions on this record
Are these flaws being exploited?
HPE stated on October 22, 2026 that it knew of no public exploit code. It also knew of no exploitation in the wild. None of the eight IDs appears in the CISA KEV catalog as checked on October 25, 2026. Patch before that changes.
What is ArubaOS?
ArubaOS is the operating system for HPE Aruba wireless gear. It runs mobility controllers, mobility gateways, and access points. It manages Wi-Fi for offices, campuses, and plants.
What is PAPI?
PAPI is the Aruba protocol controllers and access points use to talk to each other. One 10.0 flaw bypasses its authentication. Treat that channel as untrusted until patched.
Does PolicyCortex patch Aruba devices?
No. HPE ships the fix and network teams apply it. PolicyCortex helps teams keep the evidence: which build ran, when it changed, and what the re-scan showed.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. CISA Sets a Three Day Patch Clock on a Collabora RCECISA added CVE-2026-110447 to its KEV catalog on October 23, 2026. The Collabora Online Built-in CODE Server flaw lets an attacker run code on a Nextcloud server. Federal agencies must fix it by October 26.5 min
  2. Two Okta Access Gateway Flaws, One Admin Console: Upgrade to 2026.10.2Okta published two Access Gateway advisories on October 22, 2026. One lets a signed-in user reach the admin console. The other lets an admin run system commands. Both are fixed in 2026.10.2.5 min
  3. One Shared Atlassian Component Let Attackers Read Server Files With No LoginCVE-2026-21589 gives unauthenticated arbitrary file access in eight Atlassian Data Center products through one shared component. CISA added it to the KEV catalog on October 15, 2026. Public proof of concept code exists, and decoy servers saw attacks within about two hours of the advisory.6 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere