HPE AOS-8: 25 Vulnerabilities Disclosed, Including Critical Auth Bypass and RCE Flaws
Key findings • 25 vulnerabilities disclosed simultaneously for HPE AOS-8 on October 22, 2026, ranging from Low to Critical severity. • Multiple critical vulnerabilities allow unauthenticated …
Key findings
- 25 vulnerabilities disclosed simultaneously for HPE AOS-8 on October 22, 2026, ranging from Low to Critical severity.
- Multiple critical vulnerabilities allow unauthenticated remote attackers to bypass authentication and gain administrative control.
- Key attack vectors include buffer overflows, command injection, and SQL injection across web interfaces, CLI, and PAPI protocol.
- Critical flaws like CVE-2026-79850 and CVE-2026-79855 enable complete device compromise, including arbitrary command execution.
- HPE has released security patches; prompt application is critical due to the severity and exploitability of these flaws.
On October 22, 2026, a significant batch of 25 vulnerabilities was disclosed for Hewlett Packard Enterprise's Aruba Operating System (AOS-8). These vulnerabilities, disclosed on the same day, span a range of severity from Low to Critical, with a notable cluster of critical flaws carrying CVSS scores of 9.3 and above. The disclosures highlight widespread security weaknesses across various components of AOS-8, including its web-based management interface, command-line interface (CLI), and the PAPI protocol. Successful exploitation of these flaws could lead to unauthorized access, remote code execution, denial of service, and complete system compromise.
A significant portion of the disclosed vulnerabilities are related to authentication bypass and command injection. CVE-2026-79850, CVE-2026-79855, CVE-2026-79866, CVE-2026-79867, and CVE-2026-79868, all rated Critical, involve authentication bypass mechanisms that could allow unauthenticated attackers to gain administrative access, modify configurations, and execute arbitrary commands. CVE-2026-79881 and CVE-2026-79880 also fall into this category, with the latter enabling server-side request forgery (SSRF) attacks.
Buffer overflow vulnerabilities are another prominent theme within this batch. CVE-2026-79859, a Critical severity flaw, allows for unauthenticated remote code execution. Other buffer overflow issues, such as CVE-2026-95707 (High), CVE-2026-79886 (High), and CVE-2026-79889 (High), present varying levels of risk, with some enabling remote code execution and others leading to denial of service. CVE-2026-95720 describes a buffer overflow leading to denial of service for authenticated administrative users.
The PAPI protocol is implicated in several high and critical severity vulnerabilities. CVE-2026-79858, a Critical SQL injection vulnerability, allows attackers to modify sensitive information and disrupt services. CVE-2026-79866, a Critical path traversal vulnerability, permits reading, modification, and deletion of files. Additionally, CVE-2026-79878, a High command injection vulnerability, can be exploited via the PAPI protocol over UDP port 8211 by adjacent attackers. CVE-2026-95712 also involves the PAPI protocol, leading to sensitive information disclosure and service disruption.
The batch also includes vulnerabilities affecting the CLI and web interface more broadly. CVE-2026-95713, a High unauthenticated buffer overflow in the CLI, can disrupt interface availability and lead to data modification. CVE-2026-79956, a High vulnerability in the CLI command handling of the web interface, allows for arbitrary command execution. CVE-2026-79955, a High unauthenticated memory corruption vulnerability in a PAPI-accessed service, can lead to denial of service.
HPE has addressed these vulnerabilities through security patches, as indicated by HPE's security bulletin HPESBNW05162. The related news coverage from Cyber Security News highlights that these flaws affect AOS-8 and AOS-10 deployments across various HPE Aruba networking devices, including Mobility Conductors, Controllers, Gateways, and access points. The urgency for patching is emphasized due to the potential for complete device control and the fact that several critical flaws can be exploited without authentication.
Network administrators using HPE AOS-8 are urged to apply the available security patches immediately to mitigate the risks associated with these numerous and severe vulnerabilities. The widespread nature of these flaws, affecting critical components like authentication, command execution, and data integrity, necessitates prompt action to prevent potential system compromise and data breaches. Continued vigilance and adherence to HPE's security advisories are crucial for maintaining the security posture of AOS-8 deployments.