HPE patches 72 ArubaOS flaws, eight rated maximum severity

HPE has released security updates that fix 72 vulnerabilities in ArubaOS (AOS), eight of which are rated maximum severity, according to bleepingcomputer.com. The critical flaws cover authentication bypass and remote code execution issues.

The eight maximum-severity bugs affect multiple AOS-8 and AOS-10 versions and are remotely exploitable without privileges or user interaction. The advisory lists them as CVE-2026-79844 through CVE-2026-79851, covering authentication bypass, command injection, buffer overflow and SQL injection that can lead to remote code execution.

HPE urged customers to patch promptly. It also recommended restricting the command-line and web management interfaces to a dedicated Layer 2 segment or VLAN and to firewall policies.

The vendor said it is not aware of public exploit code or in-the-wild exploitation of these vulnerabilities.

Earlier HPE security notices

HPE has issued several networking and storage security alerts in the past two years. In June 2025 it patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution, and a month later it warned of hardcoded credentials in Aruba Instant On Access Points. In January 2025, CISA flagged a maximum-severity HPE OneView vulnerability as exploited in attacks. More recently, HPE warned of critical flaws allowing admin password resets and remote code execution on unpatched AOS-CX devices.