HPE Fixes 72 ArubaOS Vulnerabilities, Eight Rated CVSS 10.0
HPE released fixes for 72 vulnerabilities in AOS-8 and AOS-10. Eight flaws received the maximum CVSS score of 10.0 and include remote code execution and authentication bypass issues.
Vulnerabilities in HPE ArubaOS are addressed in a large patch release for enterprise wireless infrastructure. On October 22, 2026, HPE released security bulletin HPESBNW05162, which addresses 72 CVEs in HPE Networking AOS-8 and AOS-10 products. Eight received the maximum CVSS 3.1 score of 10.0.
The most serious issues include flaws enabling authentication bypass, remote code execution, SQL injection, command injection and buffer overflow. HPE released fixed software versions and recommends that administrators update affected systems without delay.
Vulnerabilities in HPE ArubaOS Affect Controllers and Access Points
The fixes apply to ArubaOS deployments on mobility conductors, controllers, gateways and selected access points. These devices form part of the network layer in enterprise environments and provide management or operation of wireless infrastructure.
According to HPE, some flaws could allow an unauthenticated attacker to compromise a device if the affected network interface is accessible. In such a compromise, an attacker could interfere with network configuration or gain a foothold for further movement within the environment.
The specific risk in individual organizations depends on the AOS version in use and whether management or PAPI interfaces are accessible from the network.
Recommended Fixed Versions and Temporary Restrictions
HPE lists fixed builds for the individual supported branches. Administrators should verify the version in use and deploy the applicable update:
- AOS-10: versions 10.8.1.2, 10.7.2.7 and 10.4.1.14,
- AOS-8: versions 8.13.3.1 and 8.10.0.24.
Until the update is applied, HPE recommends isolating access to command-line and web management interfaces in a separate VLAN or segment. Access should also be restricted by firewall rules.
A practical priority is to review which segments can access management interfaces and PAPI traffic. During patch deployment, it is advisable to monitor unusual access to these interfaces from untrusted parts of the network.
HPE Does Not Yet Know of a Public Exploit
When the security notice was issued, HPE stated that it was not aware of a publicly available exploit or active exploitation of any specific patched flaws. Independent confirmation of real-world exploitation of any of the 72 vulnerabilities is not currently available.
Further developments will also depend on whether HPE or the U.S. agency CISA later confirms active exploitation, or whether any CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Sources
- HPE Networking security bulletin HPESBNW05162 – HPE’s primary bulletin confirms the release of fixes, the scope of the vulnerabilities, recommended management segmentation and the known exploit status.
- CVE Program – CVE records assigned to HPE – The CVE record confirms the maximum CVSS score and the nature of one critical flaw in the HPESBNW05162 advisories.
- BleepingComputer – Independently summarizes the 72 fixed vulnerabilities, eight flaws with a CVSS score of 10.0 and HPE’s statement that no known public exploit exists.
Verified and updated: October 23, 2026 15:21
