Threat reportVulnerabilityTL-2026-4267
HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and Authentication Bypass Flaws (CVE-2026-79844 to CVE-2026-79851)
HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and (TL-2026-4267), also tracked as hpesbnw05162en_us, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-23. It has no confirmed attribution, affects HPE (Aruba Networking) ArubaOS AOS-10, references 8 CVEs (CVE-2026-79844, CVE-2026-79845, CVE-2026-79846), maps to 4 MITRE ATT&CK techniques (T1059, T1133, T1190), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4267
- Threat ID
- TL-2026-4267
- Also known as
- hpesbnw05162en_us
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, government administration, education, health, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and works
On 2026-10-23 HPE patched eight maximum-severity vulnerabilities in ArubaOS 8 and 10 covering unauthenticated command injection, SQL injection leading to RCE, buffer overflows leading to RCE and authentication bypasses (including in the PAPI protocol). HPE reports no known public discussion or exploit code and no known in-the-wild exploitation.
HPE security bulletin hpesbnw05162en_us addresses eight vulnerabilities rated at maximum severity in ArubaOS, the operating system for Aruba mobility conductors, controllers, access points and gateways. Per BleepingComputer's reporting of the advisory, the flaws are remotely exploitable by unauthenticated attackers through low-complexity attacks that require no user interaction.
AOS-10 is affected by CVE-2026-79844 (authentication bypass leading to RCE), CVE-2026-79845 (authentication bypass in the PAPI protocol), and CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows leading to RCE). AOS-8 is affected by CVE-2026-79846 (unauthenticated command injection), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection leading to RCE), and CVE-2026-79850 (authentication bypass leading to RCE). NVD records list CWE-288 (authentication bypass using an alternate path) for CVE-2026-79844 and CVE-2026-79850, CWE-89 for CVE-2026-79848 and CVE-2026-79849, and CWE-119 for CVE-2026-79847 and CVE-2026-79851. NVD lists CVSS 3.1 base score 10.0 for each (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H on the command injection, SQL injection and buffer overflow entries; the two CWE-288 entries carry A:N in the published vector). The NVD record for CVE-2026-79845 currently resolves to an unrelated third-party product (code-projects Simple Inventory System) and was not used for scoring or affected-version data; its PAPI authentication bypass classification comes from the HPE advisory as reported by BleepingComputer.
NVD affected ranges (product listed only as 'HPE Unknown') are AOS-10 10.3.0.0-10.4.1.13, 10.6.0.0-10.7.2.6 and 10.8.0.0-10.8.1.1, and AOS-8 8.10.0.0-8.10.0.23 and 8.12.0.0-8.13.3.0. Fixed version numbers, discoverer credit and per-CVE technical descriptions were not available in the sources reviewed (the HPE portal page returned no content to the fetcher). The attack surface is the CLI and web-based management interfaces and the PAPI protocol. HPE's mitigation guidance is to restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or control them with layer 3 firewall policies. HPE states it is not aware of public discussion or exploit code for these issues as of release. Because ArubaOS controllers and gateways sit at the network edge and manage wireless infrastructure, a successful compromise would give an attacker a privileged foothold on network infrastructure.
MITRE ATT&CK techniques used in TL-2026-4267
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Credential Access
Affected products and versions in HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and
- HPE (Aruba Networking) — ArubaOS AOS-10
Vulnerable versions: 10.3.0.0 - 10.4.1.13; 10.6.0.0 - 10.7.2.6; 10.8.0.0 - 10.8.1.1
Fixed in: See HPE bulletin hpesbnw05162en_us - HPE (Aruba Networking) — ArubaOS AOS-8
Vulnerable versions: 8.10.0.0 - 8.10.0.23; 8.12.0.0 - 8.13.3.0
Fixed in: See HPE bulletin hpesbnw05162en_us
Remediation for HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and
Patches
- Apply the fixed ArubaOS releases listed in HPE security bulletin hpesbnw05162en_us
Immediate actions
- Restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN
- Control management interface access with layer 3 firewall policies
- Inventory all ArubaOS 8 and 10 conductors, controllers, gateways and access points against the affected version ranges
Workarounds
- Management-interface segmentation and firewall restriction as advised by HPE
Longer-term hardening
- Keep management-plane interfaces off untrusted and internet-facing networks
- Monitor ArubaOS management and PAPI traffic for access from unexpected sources
CVEs associated with HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and
CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851
Weaknesses (CWE) in HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and
Timeline of HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and
- NVD publishes CVE records CVE-2026-79844 and CVE-2026-79846 through CVE-2026-79851 for ArubaOS, each scored CVSS 3.1 10.0 and referencing HPE bulletin hpesbnw05162en_us.
- Advisory scope per BleepingComputer: CVE-2026-79844, -79845, -79847 and -79851 affect AOS-10; CVE-2026-79846, -79848, -79849 and -79850 affect AOS-8.
- BleepingComputer reports the same HPE ArubaOS security update addresses 72 vulnerabilities in total, of which eight are rated maximum severity.
- BleepingComputer reports the eight flaws, including unauthenticated command injection, SQL injection to RCE, buffer overflows to RCE and PAPI authentication bypass.
- HPE states it is not aware of public discussion or exploit code for the flaws; no in-the-wild exploitation reported.
- HPE advises restricting CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or controlling them with layer 3 firewall policies.
- HPE releases security bulletin hpesbnw05162en_us and patches for eight maximum-severity ArubaOS 8 and 10 vulnerabilities.
Sources cited for HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and
Detection coverage for TL-2026-4267
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4267 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.