---
title: "HPE ArubaOS Eight CVSS 10.0 Flaws: Patch AOS-8 and AOS-10"
description: "HPE advisory HPESBNW05162 fixes 72 ArubaOS flaws. HPE rates eight at CVSS 10.0. Seven resolve cleanly, and one ID currently points elsewhere."
url: https://policycortex.com/blog/hpe-arubaos-100-flaws
sealed: 2026-10-25
register: blog/hpe-arubaos-100-flaws
records: 3
digest: sha3:f27655d4409bb765210db615e8a2af3ecf2a8188781bc46bda0a91cba8807213
---

# Eight Listed 10.0 Flaws in HPE ArubaOS: Patch Your Wireless Controllers Now

Resources / Blog

HPE published advisory HPESBNW05162 on October 22, 2026. It fixes 72 flaws in ArubaOS 8 and 10. HPE rates eight at 10.0, and one of those IDs needs a closer look.

Leonard Esere · Sealed 2026-10-25 · Reading time 5 min

Filed under: [HPE](https://policycortex.com/blog/tags/hpe), [ArubaOS](https://policycortex.com/blog/tags/arubaos), [wireless](https://policycortex.com/blog/tags/wireless), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [governance](https://policycortex.com/blog/tags/governance)

**Summary**

- HPE published advisory HPESBNW05162 on October 22, 2026, covering 72 flaws in ArubaOS 8 and 10.
- HPE rates eight flaws at CVSS 3.1 10.0. Seven resolve to HPE records. One ID currently resolves to another product.
- The worst flaws give an unauthenticated attacker privileged code execution on controllers, gateways, and access points.
- Fixed builds are AOS-10 10.8.1.2, 10.7.2.7, and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24.
- HPE reports no known public exploit code and no known exploitation in the wild as of the advisory date.

## A wireless patch with eight perfect scores

HPE Networking published security advisory HPESBNW05162 on October 22, 2026. It covers the wireless operating systems AOS-8 and AOS-10. The advisory fixes 72 flaws in total. HPE rates eight of them at a perfect 10.0. Seven of those IDs resolve to HPE records. The eighth needs a note, covered below.

A perfect score is rare. One is a warning. Eight at once is a patch window, not a patch someday.

## The eight listed 10.0 flaws

Every flaw below needs network access only. No login is needed. No user must click anything.

The AOS-10 flaws:

- [CVE-2026-79844](https://www.cve.org/CVERecord?id=CVE-2026-79844) is an authentication bypass. It lets an unauthenticated attacker run arbitrary commands on the host. HPE notes certain preconditions outside the attacker's control must also be met.
- [CVE-2026-79845](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US) is a bypass in PAPI, the Aruba control protocol. HPE lists it at 10.0. Its public CVE record currently points to another product, so this article links it to the HPE advisory instead. See the note below.
- [CVE-2026-79847](https://www.cve.org/CVERecord?id=CVE-2026-79847) and [CVE-2026-79851](https://www.cve.org/CVERecord?id=CVE-2026-79851) are buffer overflows. Each allows unauthenticated remote code execution.

The AOS-8 flaws:

- [CVE-2026-79846](https://www.cve.org/CVERecord?id=CVE-2026-79846) is a command injection. It lets an unauthenticated attacker run commands on the host. HPE notes certain preconditions outside the attacker's control must also be met.
- [CVE-2026-79848](https://www.cve.org/CVERecord?id=CVE-2026-79848) and [CVE-2026-79849](https://www.cve.org/CVERecord?id=CVE-2026-79849) are SQL injections. Each can end in command execution.
- [CVE-2026-79850](https://www.cve.org/CVERecord?id=CVE-2026-79850) is an authentication bypass. It runs commands as root on the host.

Common Vulnerabilities and Exposures (CVE) is the public record system. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10. A 10.0 means the worst mix: network reach, low complexity, no login, no user action, full impact.

## One ID does not check out

HPE lists CVE-2026-79845 at 10.0 for the PAPI flaw. The public CVE record for that ID names a different product. It describes a SQL injection in Simple Inventory System. It scores 7.3, not 10.0. That looks like an ID collision. Do not treat that inventory flaw as an HPE flaw. The PAPI flaw itself comes from HPE's advisory, not from the public record. Until the record is fixed, count seven verified 10.0 IDs, not eight.

## Which builds are affected

AOS-10 builds at or below 10.8.1.1, 10.7.2.6, and 10.4.1.13 are affected. AOS-8 builds at or below 8.13.3.0 and 8.10.0.23 are affected. End of maintenance releases should be treated as affected too.

The fixed builds are AOS-10 10.8.1.2, 10.7.2.7, and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24. Upgrade to those builds or later.

## What HPE says about exploitation

HPE stated on October 22, 2026 that it knew of no public exploit code. It also knew of no exploitation in the wild. That statement covers the advisory date. The CISA Known Exploited Vulnerabilities (KEV) catalog does not list any of the eight as of October 25, 2026.

That is good news with a short shelf life. A bulletin this detailed hands researchers a map. Patch while the window is still open.

## What to do this week

First, list every Aruba controller, gateway, and access point you run. Record the build on each one. Second, upgrade affected builds to the fixed builds above. Third, re-scan and keep the dated result. Until the upgrade lands, restrict management interfaces to a dedicated management network segment. Log admin activity on every device.

## The governance lesson

Wireless gear is infrastructure, not furniture. Controllers hold Wi-Fi keys, network config, and client data. A flaw in a controller is a flaw in the network boundary itself.

Most teams track servers and laptops closely. Network boxes get less attention. They sit in closets and ceilings for years. This bulletin is the reminder to inventory them like any other system.

Your evidence file for this bulletin should hold five items. The device inventory with builds. The advisory reference. The upgrade date per device. The re-scan result. The management network restriction, if you used it. An assessor can follow that file without asking twice.

## Sources

- HPE Networking security advisory HPESBNW05162, [Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 and AOS-8)](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US), October 22, 2026.
- [CVE-2026-79844](https://www.cve.org/CVERecord?id=CVE-2026-79844) record, CVE Program.
- The PAPI flaw listed as CVE-2026-79845 is sourced to the HPE advisory above. Its public CVE record currently names another product.
- [CVE-2026-79846](https://www.cve.org/CVERecord?id=CVE-2026-79846) record, CVE Program.
- [CVE-2026-79847](https://www.cve.org/CVERecord?id=CVE-2026-79847) record, CVE Program.
- [CVE-2026-79848](https://www.cve.org/CVERecord?id=CVE-2026-79848) record, CVE Program.
- [CVE-2026-79849](https://www.cve.org/CVERecord?id=CVE-2026-79849) record, CVE Program.
- [CVE-2026-79850](https://www.cve.org/CVERecord?id=CVE-2026-79850) record, CVE Program.
- [CVE-2026-79851](https://www.cve.org/CVERecord?id=CVE-2026-79851) record, CVE Program.
- Canadian Centre for Cyber Security advisory AV26-1079, October 2026.
- Original diagram by PolicyCortex.

## Next step

Want patch evidence linked to each control, without chasing spreadsheets? See how [PolicyCortex](https://policycortex.com) collects it from live systems.

**Questions on this record**

**Q: Are these flaws being exploited?**
A: HPE stated on October 22, 2026 that it knew of no public exploit code. It also knew of no exploitation in the wild. None of the eight IDs appears in the CISA KEV catalog as checked on October 25, 2026. Patch before that changes.

**Q: What is ArubaOS?**
A: ArubaOS is the operating system for HPE Aruba wireless gear. It runs mobility controllers, mobility gateways, and access points. It manages Wi-Fi for offices, campuses, and plants.

**Q: What is PAPI?**
A: PAPI is the Aruba protocol controllers and access points use to talk to each other. One 10.0 flaw bypasses its authentication. Treat that channel as untrusted until patched.

**Q: Does PolicyCortex patch Aruba devices?**
A: No. HPE ships the fix and network teams apply it. PolicyCortex helps teams keep the evidence: which build ran, when it changed, and what the re-scan showed.

## Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

- **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes.
- **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence.

### Further reading in this register

| Published | Entry | Reading |
|---|---|---|
| 2026-10-25 | [Four 9.2 Flaws in Pillow: Upgrade to Version 13.0.0 Now](https://policycortex.com/blog/pillow-130-four-92-flaws): Pillow 13.0.0 fixes four flaws scored 9.2. They reach code execution or heap corruption through ordinary image handling. Upgrade and rebuild. | 5 min |
| 2026-10-24 | [CISA Sets a Three Day Patch Clock on a Collabora RCE](https://policycortex.com/blog/collabora-code-server-kev-rce): CISA added CVE-2026-110447 to its KEV catalog on October 23, 2026. The Collabora Online Built-in CODE Server flaw lets an attacker run code on a Nextcloud server. Federal agencies must fix it by October 26. | 5 min |
| 2026-10-24 | [Two Okta Access Gateway Flaws, One Admin Console: Upgrade to 2026.10.2](https://policycortex.com/blog/okta-oag-admin-console-command-injection): Okta published two Access Gateway advisories on October 22, 2026. One lets a signed-in user reach the admin console. The other lets an admin run system commands. Both are fixed in 2026.10.2. | 5 min |

Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

Dates of record

- **Published**: 2026-10-25
- **Last updated**: Unchanged since sealing
- **Author**: Leonard Esere
- **Record**: https://policycortex.com/blog/hpe-arubaos-100-flaws

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | HEAD | 6c7081723ca7 | e7e3830aaaab |
| REC 0001 | BODY | 96f5d4f39155 | 6c7081723ca7 |
| REC 0002 | RELATED RECORDS | f27655d4409b | 96f5d4f39155 |

Head sha3:f27655d4409bb765210db615e8a2af3ecf2a8188781bc46bda0a91cba8807213. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.