Hewlett Packard Enterprise has published a security bulletin fixing 72 vulnerabilities in its Aruba wireless operating systems, AOS-8 and AOS-10, including eight flaws carrying the maximum CVSS score of 10.0. The bulletin, HPESBNW05162, was published on 22 October 2026 and covers Mobility Conductors, Mobility Controllers, Central-managed Gateways and access points.

The most serious issues include authentication bypasses, command injection, SQL injection and buffer overflows. One AOS-8 flaw, CVE-2026-79850, is reported to let an attacker bypass authentication and execute commands as root, giving full control of the device's underlying operating system. An AOS-10 flaw in PAPI, the protocol controllers and access points use to communicate, is reported to allow authentication bypass, configuration changes and access to sensitive information.

What administrators should do now

Many of the flaws require no credentials at all, and some can be reached through PAPI traffic or the web management interface, while others need an attacker on an adjacent network. HPE says it is not aware of public exploit code or exploitation of these flaws, and that most were found by its own researchers. That position should not be read as a reason to delay: maximum-severity, unauthenticated flaws in network infrastructure are exactly the kind of issue attackers study once fixes are public.

Administrators should upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24, depending on their release train, and in the meantime restrict management and PAPI access to a dedicated management network. Checking every controller, gateway and access point for its version matters, because wireless estates are easy to undercount.