HPE Patches Critical Aruba Networking Flaws Allowing Full Device Control
Hewlett Packard Enterprise has released patches for critical vulnerabilities in its Aruba Networking software, including flaws that allow unauthenticated remote attackers to gain complete control of devices.
Hewlett Packard Enterprise has issued urgent security patches for a series of critical vulnerabilities affecting its Aruba Networking software, specifically impacting AOS-8 and AOS-10 deployments. These flaws, present in Mobility Conductors, Controllers, Gateways, and access points, could allow unauthenticated remote attackers to achieve complete control over the affected network devices. The company strongly recommends immediate upgrades to mitigate the significant risks posed by these weaknesses.
The security bulletin, HPESBNW05162, details a range of vulnerabilities including authentication bypass, command injection, SQL injection, and buffer overflows. Notably, eight of these CVE entries have been assigned the maximum CVSS severity score of 10.0, indicating a critical level of risk. Successful exploitation could lead to the exposure of sensitive data, unauthorized modification of device configurations, or the execution of commands with the highest system privileges.
Among the most severe issues is CVE-2026-79850, which affects AOS-8 and allows an attacker to bypass authentication mechanisms without any credentials. This grants them the ability to execute commands as the root user, effectively providing full control over the device's operating system. Another critical flaw, CVE-2026-79855, impacts the AOS-8 SSH service and can similarly grant unauthenticated administrative access.
The AOS-10 software is also affected by critical weaknesses. CVE-2026-79845, for instance, targets PAPI, Aruba's protocol for managing access points. This vulnerability could enable attackers to bypass login checks, alter device configurations, and access sensitive information. Additionally, CVE-2026-79847 and CVE-2026-79851 involve buffer overflows that could be exploited to run malicious code with privileged permissions.
Further complicating the threat landscape, other vulnerabilities allow for command execution through specially crafted packets sent to specific UDP ports, such as UDP port 8211 on affected AOS-8 systems (CVE-2026-79860). The bulletin also lists SQL injection flaws that could extend beyond database manipulation to allow for command execution on the underlying operating system.
The affected software versions include AOS-10.8.1.1, AOS-10.7.2.6, and AOS-10.4.1.13 and earlier releases within their respective branches. For AOS-8, versions prior to AOS-8.13.3.0 and AOS-8.10.0.23 are vulnerable. Both hardware and virtual deployments running these versions are at risk.
HPE recommends upgrading to specific patched versions, such as AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, or AOS-8.10.0.24, depending on the installed branch. While HPE stated it was unaware of any public exploitation or discussion of these vulnerabilities at the time of the advisory, the company urges customers to apply the patches as soon as possible. As a temporary mitigation, HPE suggests restricting access to command line and web management interfaces to dedicated network segments and implementing firewall rules. Enabling user activity logging is also recommended.
This disclosure highlights the ongoing challenges in securing complex network infrastructure. As devices become more interconnected and sophisticated, the potential impact of even a single vulnerability can be severe, underscoring the critical need for prompt patching and robust security practices across all network components.