---
title: HPE patches Aruba wireless AOS-8 and AOS-10: eight unauthenticated RCE and auth-bypass flaws, including a CVSS 10.0 | ctxsec
url: https://ctxsec.com/items/hpe-aruba-aos-hpesbnw05162-eight-critical
description: ""
status: "confirmed (HPE advisory HPESBNW05162, Oct 22); HPE knows of no public exploit or exploitation"
published: 2026-10-23
---

> 

[← Cybersecurity News](/news) · [markdown](/items/hpe-aruba-aos-hpesbnw05162-eight-critical.md)

confirmed (HPE advisory HPESBNW05162, Oct 22); HPE knows of no public exploit or exploitation

2026-10-23

### HPE patches Aruba wireless AOS-8 and AOS-10: eight unauthenticated RCE and auth-bypass flaws, including a CVSS 10.0

HPE Networking advisory **HPESBNW05162** (Oct 22, Critical) fixes a large batch of bugs in the wireless operating systems that run Aruba Mobility Conductors, Controllers, Gateways, AOS-10 access points and AOS-8 Instant APs. BleepingComputer counts 72 CVEs; eight are rated maximum severity and need no credentials or user interaction:

- **AOS-10:** CVE-2026-79844 (auth bypass to RCE, CVSS 10.0), CVE-2026-79845 (auth bypass in the PAPI protocol), CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows to RCE).
- **AOS-8:** CVE-2026-79846 (unauthenticated command injection), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection to RCE), CVE-2026-79850 (auth bypass to RCE).

**Fixed in** 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24 or later. HPE says end-of-maintenance versions should be presumed affected. Until you upgrade, HPE recommends putting the CLI and web management interfaces on a dedicated VLAN or behind firewall rules. HPE found the flaws internally and says it knows of no public discussion or exploit code, but wireless controllers are a frequent target, so treat this as a priority patch.

Sources: [HPE Networking advisory HPESBNW05162 (CSAF text, Oct 22)](https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt) · [CVE-2026-79844 record (CVSS 10.0)](https://www.cve.org/CVERecord?id=CVE-2026-79844) · [Canadian Centre for Cyber Security AV26-1079](https://www.cyber.gc.ca/en/alerts-advisories/hpe-security-advisory-av26-1079) · [BleepingComputer (Oct 23)](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/)