HPE Networking advisory HPESBNW05162 (Oct 22, Critical) fixes a large batch of bugs in the wireless operating systems that run Aruba Mobility Conductors, Controllers, Gateways, AOS-10 access points and AOS-8 Instant APs. BleepingComputer counts 72 CVEs; eight are rated maximum severity and need no credentials or user interaction:

• AOS-10: CVE-2026-79844 (auth bypass to RCE, CVSS 10.0), CVE-2026-79845 (auth bypass in the PAPI protocol), CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows to RCE).
• AOS-8: CVE-2026-79846 (unauthenticated command injection), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection to RCE), CVE-2026-79850 (auth bypass to RCE).

Fixed in 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24 or later. HPE says end-of-maintenance versions should be presumed affected. Until you upgrade, HPE recommends putting the CLI and web management interfaces on a dedicated VLAN or behind firewall rules. HPE found the flaws internally and says it knows of no public discussion or exploit code, but wireless controllers are a frequent target, so treat this as a priority patch.