Hewlett Packard Enterprise has released fixes for a large group of security defects in Aruba Networking software, including eight vulnerabilities assigned the maximum CVSS score of 10.0. Several can be exploited without valid credentials and may allow attackers to take administrative control, execute commands with high privileges or alter network configurations.

The October 22 bulletin covers AOS-8 and AOS-10 deployments across Mobility Conductors, Controllers, Gateways and access points. The weaknesses span authentication bypass, command injection, SQL injection and memory corruption, creating more than one possible route into infrastructure that often occupies a trusted position in enterprise networks.

Unauthenticated paths to root and administration

Among the most severe issues, CVE-2026-79850 allows an unauthenticated attacker to bypass AOS-8 access controls and execute operating-system commands as root. CVE-2026-79855 separately affects the AOS-8 SSH service and can provide administrative access without a login.

AOS-10 is also exposed. CVE-2026-79845 affects PAPI, Aruba’s protocol for access-point management, and may permit an attacker to bypass authentication, change configurations and read sensitive information. Two buffer-overflow vulnerabilities, CVE-2026-79847 and CVE-2026-79851, can lead to privileged code execution.

Other flaws affect services reachable through PAPI traffic. One AOS-8 issue, CVE-2026-79860, can be triggered with specially formed packets sent to UDP port 8211. The bulletin also describes SQL injection weaknesses whose impact can extend beyond database records to command execution on the underlying operating system.

Attack requirements differ across the set. Some defects are remotely reachable, while others require an adjacent-network position or physical access. Certain command-execution paths depend on environmental conditions the attacker cannot control. Administrators should therefore consult the vendor matrix for their exact architecture rather than assume every CVE has identical exposure.

Affected and corrected releases

The vulnerable versions include AOS-10.8.1.1, 10.7.2.6 and 10.4.1.13 and earlier releases in their respective branches. AOS-8.13.3.0 and AOS-8.10.0.23 and earlier branch releases are also affected. Both compatible physical hardware and virtual deployments fall within scope, even if a particular model is not listed among examples.

HPE recommends moving to one of the following fixed builds, or a later version in the same branch:

• AOS-10.8.1.2
• AOS-10.7.2.7
• AOS-10.4.1.14
• AOS-8.13.3.1
• AOS-8.10.0.24

Updates are available through the HPE Networking Support Portal. Devices running software that has left maintenance or support should not be presumed unaffected; the vendor recommends migrating them to a supported release.

Reduce management-plane exposure

Until upgrades are complete, HPE advises placing command-line and web management interfaces on a dedicated network segment or VLAN and enforcing access through firewall rules. Organizations should also enable detailed controls and logs for administrator activity. These measures can make exploitation harder and improve detection, but they do not correct the underlying vulnerabilities.

Network teams should inventory controllers, gateways, conductors and access points by software branch, then prioritize internet-exposed or broadly reachable management services. Monitoring UDP 8211 and PAPI-related traffic for anomalies may provide additional warning. After patching, administrators should validate configurations and review privileged-account and command logs for unexpected changes.

No public exploit reported at disclosure

HPE said it was not aware of public discussion or exploit code when the advisory was issued. That lowers immediate evidence of widespread abuse but is not proof that attacks have never occurred. Maximum-severity vulnerabilities affecting authentication and root-level execution tend to attract rapid interest once technical details become available.

With eight CVSS 10.0 entries arriving together, treating the bulletin as routine patching would underestimate the risk. Segmentation and logging provide useful defense in depth, but timely upgrades are the only reliable way to remove these newly disclosed attack paths.