HPE patches eight max severity RCE and auth bypass AOS flaws

Hewlett Packard Enterprise released security updates patching 72 vulnerabilities across Aruba Operating System, including eight maximum-severity authentication bypass and remote code execution flaws. Also known as AOS, the software powers Aruba Networking enterprise wireless infrastructure across mobility conductors, access points, controllers, and gateways. As detailed in BleepingComputer's report, the critical flaws affect multiple AOS-8 and AOS-10 versions, enabling unprivileged remote attackers to execute low-complexity attacks without user interaction.

This technical report details the breakdown of these eight maximum-severity vulnerabilities, the immediate defensive mitigations mandated by HPE, and the exposure risks facing enterprise administrators. Organizations operating Aruba wireless infrastructure rely on these systems to manage campus network traffic and authenticate connected endpoints. Because unpatched controllers and gateways expose internal network segments, network engineering and security teams must evaluate these critical flaws across both AOS-8 and AOS-10 deployments to prevent unauthorized device takeovers.

What broke in HPE eight max severity RCE and auth bypass

The security advisory resolves 72 vulnerabilities, headlined by eight maximum-severity flaws that permit unauthenticated remote code execution. Within the AOS-10 branch, HPE patched CVE-2026-79844, an authentication bypass defect that leads directly to remote code execution. Additionally, CVE-2026-79845 introduces an authentication bypass flaw inside the PAPI protocol handler of AOS-10. Memory safety flaws also surfaced under CVE-2026-79847 and CVE-2026-79851, where unauthenticated buffer overflow vulnerabilities permit remote attackers to overwrite process memory buffers and execute arbitrary system commands on affected network appliances.

For installations running the AOS-8 branch, four additional maximum-severity vulnerabilities threaten device integrity. CVE-2026-79846 constitutes an unauthenticated command injection flaw in AOS-8, allowing remote threat actors to run system commands directly without prior credential verification. Database processing defects also emerged as unauthenticated SQL injection bugs under CVE-2026-79848 and CVE-2026-79849, enabling attackers to inject database commands to achieve remote code execution. Finally, CVE-2026-79850 provides an authentication bypass mechanism leading to remote code execution across unpatched AOS-8 appliances, granting external actors complete administrative control over vulnerable network hardware.

Who is exposed by HPE eight max severity RCE and auth bypass

Organizations deploying Aruba Networking enterprise wireless hardware driven by vulnerable AOS-8 and AOS-10 firmware are directly exposed to compromise. ArubaOS operates across mobility conductors, physical access points, mobility controllers, and enterprise gateways that route corporate communications. HPE maintains a substantial global enterprise footprint, employing more than 61,000 workers worldwide and providing products and services to over 55,000 enterprise customers globally. With Aruba infrastructure utilized across 90% of Fortune 500 companies, the exposure profile encompasses large corporate networks, financial institutions, healthcare environments, universities, and distributed remote branch offices.

The risk landscape is compounded because threat actors targeting infrastructure appliances face minimal defensive resistance once boundaries fall. Findings from The Blue Report 2026, which measured defensive controls across 338 million simulations in customer production environments, showed that once attackers obtain valid credentials, prevention drops sharply and defenses block only 37% of malicious actions. Because these eight AOS defects allow remote operators to bypass authentication entirely without credentials, attackers can access critical network controllers unhindered, creating risks similar to previous incidents like the January 2025 HPE OneView flaw flagged by CISA.

What to do now about HPE eight max severity RCE and auth bypass

Administrators must immediately apply the official security updates released by HPE across all vulnerable AOS-8 and AOS-10 instances. Emphasizing the urgency of these defects, the vendor warned in its Thursday advisory: "Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities." Engineering teams should audit their deployed inventory of mobility conductors, controllers, and gateways, schedule emergency maintenance windows, and flash updated software builds before threat actors develop functional exploit tools against unpatched appliances.

If operational constraints prevent immediate patching, network administrators must deploy defensive network segmentation controls specified by HPE. The vendor provided explicit architectural recommendations: "To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage." Enforcing strict VLAN isolation and upstream firewall rules prevents unauthorized network traffic from reaching exposed management ports.

How the HPE eight max severity RCE and auth bypass issue works

These eight maximum-severity vulnerabilities allow remote threat actors without credentials to compromise devices through low-complexity attacks requiring zero user interaction. An attacker on an adjacent or reachable network transmits crafted network packets toward active device management services. In AOS-10 systems, CVE-2026-79845 subverts authentication within the PAPI protocol processing handler. Concurrently, buffer overflow flaws CVE-2026-79847 and CVE-2026-79851 fail to validate incoming input lengths, enabling malformed packets to overwrite stack memory, redirect program execution, and run arbitrary system commands with elevated operating system privileges on target equipment.

Within the AOS-8 operating architecture, flaws in command parsing and database querying yield direct execution pathways. Under CVE-2026-79846, insufficient sanitization of administrative input parameters enables arbitrary shell commands to execute directly on the underlying operating system. Additionally, CVE-2026-79848 and CVE-2026-79849 represent unauthenticated SQL injection flaws that allow external attackers to manipulate database transactions and achieve remote code execution. Combined with authentication bypass bug CVE-2026-79850, remote adversaries can bypass credential validation, trigger arbitrary code execution, and establish full control over vulnerable enterprise wireless gateways without authorization.

What is still unknown about HPE eight max severity RCE and auth bypass

The primary unknown is when functional proof-of-concept exploit code will appear publicly or whether threat groups have quietly developed working exploit chains. HPE confirmed that at the time of its advisory release, it had observed no active exploitation or public exploit tools targeting these bugs. The vendor noted: "HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory." However, because threat actors routinely reverse-engineer vendor patches, public exploit material could surface rapidly once firmware updates are analyzed.

It also remains to be seen whether enterprise teams will successfully isolate vulnerable devices before malicious actors target exposed management ports. HPE devices have faced repeated security scrutiny, including June 2025 patches for eight critical StoreOnce flaws, a July 2025 warning regarding hardcoded credentials in Aruba Instant On Access Points, and recent advisories on admin password resets and remote code execution in AOS-CX devices. Whether organizations will patch their deployments before threat actors target these unauthenticated AOS-8 and AOS-10 flaws remains the defining operational question facing enterprise defenders.