VYPR
Vypr IntelligenceAI-generatedOct 22, 2026· 25 CVEs

HPE AOS: 25 Vulnerabilities Disclosed Together, Including Critical RCE and Auth Bypass Flaws

HPE disclosed 25 vulnerabilities in Aruba Operating System (AOS) 8 and 10, including critical flaws enabling RCE and authentication bypass.

Key findings

  • 25 vulnerabilities disclosed simultaneously for HPE AOS 8 and 10 on October 22, 2026.
  • High-severity flaws include RCE, authentication bypass, and DoS, impacting system integrity and availability.
  • Key attack vectors include command injection, buffer overflows, and memory corruption across various interfaces.
  • HPE has released security patches; prompt application is critical due to exploitability.
  • The batch includes vulnerabilities affecting both AOS-8 and AOS-10.

On October 22, 2026, Hewlett Packard Enterprise (HPE) disclosed a significant batch of 25 vulnerabilities affecting its Aruba Operating System (AOS), spanning versions 8 and 10. These vulnerabilities, all disclosed on the same day, range in severity from Low to High, with a notable cluster of High-severity flaws enabling critical security risks such as authentication bypass and remote code execution (RCE). The coordinated disclosure highlights potential widespread risks for organizations relying on HPE's networking infrastructure.

Several vulnerabilities center on command injection and buffer overflows, allowing attackers to execute arbitrary commands on the underlying operating system. For instance, CVE-2026-95715 and CVE-2026-95706, both High-severity command injection flaws in AOS-10 and AOS-8 respectively, could lead to complete system compromise if exploited by an attacker with physical access or administrative privileges. Similarly, CVE-2026-79889, a High-severity buffer overflow in AOS-8's web interface, allows unauthenticated remote attackers to execute arbitrary commands.

The batch also includes critical authentication bypass vulnerabilities. CVE-2026-79887, a High-severity flaw in AOS-8's web interface, and CVE-2026-95716, a Medium-severity flaw in AOS-10's PAPI protocol, could allow unauthenticated attackers to circumvent security controls and alter system settings or gain administrative control.

Denial of Service (DoS) vulnerabilities are also present, with several High-severity flaws like CVE-2026-79955 and CVE-2026-79894 in AOS-8 and AOS-10 respectively, allowing unauthenticated remote attackers to disrupt service availability. CVE-2026-95720, a Medium-severity buffer overflow in AOS-8, can also lead to a DoS condition that prevents the system from rebooting without manual intervention.

Memory corruption vulnerabilities are another theme, with CVE-2026-95721 (Low-severity) allowing local attackers to view system files, while CVE-2026-79892 (High-severity) in AOS-8 allows authenticated local attackers to execute arbitrary code. CVE-2026-79893 in AOS-10 also presents a High-severity memory corruption leading to DoS.

HPE has released security patches to address these vulnerabilities. Prompt application of these patches is critical for all affected AOS versions to mitigate the risk of exploitation, especially given the presence of critical flaws that could lead to complete device compromise. Organizations should consult HPE's advisories for specific version information and remediation steps.

The sheer number and severity of vulnerabilities disclosed simultaneously underscore the importance of timely patching and security vigilance for HPE network devices. The presence of multiple critical RCE and authentication bypass flaws indicates a significant risk landscape for organizations using vulnerable AOS versions. Users are advised to prioritize updates and review their security configurations to prevent potential compromises.

The Hacker News and Vypr Intelligence have covered this disclosure, noting the widespread impact and the critical nature of several flaws, including authentication bypass and RCE capabilities. The coordinated disclosure of these 25 vulnerabilities on October 22, 2026, presents a substantial challenge for security teams managing HPE Aruba environments.

The batch includes:

The disclosure window for this batch was extremely narrow, with all 25 CVEs published on October 22, 2026. HPE has released security patches for these vulnerabilities.

The Hacker News and Vypr Intelligence have reported on this batch of vulnerabilities. N1 N2

AI-written article. Grounded in 25 CVE records listed below.