GoKawiilHPE fixes 72 ArubaOS flaws including eight maximum-severity RCE bugs
Hewlett Packard Enterprise issued patches addressing 72 vulnerabilities in ArubaOS, the software running Aruba Networking's mobility conductors, access points, controllers and gateways. Eight of the flaws, spanning AOS-8 and AOS-10, carry maximum severity ratings and allow unauthenticated remote attackers to bypass authentication or execute code without user interaction.
GoKawiil's interpretation of the reporting above, not reported fact.
The low attack complexity and lack of required privileges make these bugs especially attractive to attackers scanning for exposed management interfaces, which could let intruders take over network infrastructure at scale. HPE's recommendation to isolate management interfaces on dedicated VLANs or behind firewall policies suggests the company views immediate network segmentation as a necessary stopgap for organizations that cannot patch right away.
- HPE patched 72 ArubaOS vulnerabilities, eight rated maximum severity.
- Flaws affect AOS-8 and AOS-10 and allow unauthenticated RCE or auth bypass.
- HPE urges prompt patching and recommends restricting access to management interfaces as mitigation.
Source: bleepingcomputer.com, 2026-10-23
Published there as: “HPE patches eight max severity RCE and auth bypass AOS flaws”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.