HPE fixes three ArubaOS authentication bypass flaws among eight maximum-severity bugs
HPE patched 72 ArubaOS vulnerabilities, eight of them maximum severity, including authentication bypasses CVE-2026-79844 and CVE-2026-79845 in AOS-10 and CVE-2026-79850 in AOS-8. HPE knew of no public exploit code or in-the-wild use.
Hewlett Packard Enterprise released updates for 72 vulnerabilities in ArubaOS (AOS), the operating system for its Aruba wireless controllers and gateways, in an advisory published Thursday, October 22, BleepingComputer reported on October 23. Eight are rated maximum severity across multiple AOS-8 and AOS-10 versions. Three are authentication bypasses: CVE-2026-79844 leads to remote code execution in AOS-10, CVE-2026-79845 bypasses authentication in AOS-10's PAPI protocol, and CVE-2026-79850 leads to remote code execution in AOS-8. The other five maximum-severity flaws (CVE-2026-79846 through 79849 and CVE-2026-79851) are command injection, buffer overflow and SQL injection bugs. HPE said it was not aware of public discussion or exploit code targeting any of them. Its interim advice is to restrict CLI and web management interfaces to a dedicated layer 2 segment or VLAN, or to firewall them with logging.
Why it matters
Wireless controllers decide who joins the corporate network. They hold RADIUS shared secrets, directory bind settings and the 802.1X policy that ties a device to an identity, so an unauthenticated path to code execution on a controller is a path to rewriting network access policy for everyone.
Patch AOS-8 and AOS-10 controllers and gateways using the fixed builds in HPE advisory HPESBNW05162. Until then, keep management interfaces and PAPI off user and guest VLANs. After patching, rotate the RADIUS shared secrets and any LDAP or AD bind accounts configured on the controllers, the same step that mattered in this week's k0t edge-device campaign. Edge bugs that started unexploited have rarely stayed that way.
Source: BleepingComputer
Related on Start with Identity
- BlogCisco ISE authentication bypass, CVSS 10, was exploited before the patch
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. C
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- CVEIvanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
One crafted X-DSCGI-PATH header lets an unauthenticated attacker past Ivanti Connect Secure's login and into command execution. Exploited since early October 20
- CVEIvanti Sentry authentication bypass
Ivanti Sentry (MobileIron Sentry) skipped authentication on an administrative API. CISA KEV. August 2023. The gateway in front of EPMM had its own unlocked door