# HPE fixes three ArubaOS authentication bypass flaws among eight maximum-severity bugs

Source: https://startwithidentity.com/blog/2026-10-23-hpe-fixes-three-arubaos-authentication-bypass-flaws-among-eight-max-severity-bugs/
Last updated: 2026-10-23
License: content by Start with Identity. Cite the source URL.

---

Hewlett Packard Enterprise released updates for 72 vulnerabilities in ArubaOS (AOS), the operating system for its Aruba wireless controllers and gateways, in an advisory published Thursday, October 22, BleepingComputer reported on October 23. Eight are rated maximum severity across multiple AOS-8 and AOS-10 versions. Three are authentication bypasses: CVE-2026-79844 leads to remote code execution in AOS-10, CVE-2026-79845 bypasses authentication in AOS-10's PAPI protocol, and CVE-2026-79850 leads to remote code execution in AOS-8. The other five maximum-severity flaws (CVE-2026-79846 through 79849 and CVE-2026-79851) are command injection, buffer overflow and SQL injection bugs. HPE said it was not aware of public discussion or exploit code targeting any of them. Its interim advice is to restrict CLI and web management interfaces to a dedicated layer 2 segment or VLAN, or to firewall them with logging.

## Why it matters

Wireless controllers decide who joins the corporate network. They hold RADIUS shared secrets, directory bind settings and the 802.1X policy that ties a device to an identity, so an unauthenticated path to code execution on a controller is a path to rewriting network access policy for everyone.

Patch AOS-8 and AOS-10 controllers and gateways using the fixed builds in HPE advisory HPESBNW05162. Until then, keep management interfaces and PAPI off user and guest VLANs. After patching, rotate the RADIUS shared secrets and any LDAP or AD bind accounts configured on the controllers, the same step that mattered in this week's [k0t edge-device campaign](https://startwithidentity.com/blog/2026-10-21-access-broker-k0t-breached-fortigate-and-globalprotect-and-exposed-70000-credentials/). Edge bugs that started unexploited have rarely stayed that way.

Source: [BleepingComputer](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/)