# HPE ArubaOS (AOS-8/AOS-10) Eight Max-Severity RCE and Authentication Bypass Flaws (CVE-2026-79844 to CVE-2026-79851)

> On 2026-10-23 HPE patched eight maximum-severity vulnerabilities in ArubaOS 8 and 10 covering unauthenticated command injection, SQL injection leading to RCE, buffer overflows leading to RCE and authentication bypasses (including in the PAPI protocol). HPE reports no known public discussion or exploit code and no known in-the-wild exploitation.

- **Published:** 2026-10-23T13:01:25Z
- **Last reviewed:** 2026-10-23T13:01:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4267
- **ID:** TL-2026-4267
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851

## Description

HPE security bulletin hpesbnw05162en_us addresses eight vulnerabilities rated at maximum severity in ArubaOS, the operating system for Aruba mobility conductors, controllers, access points and gateways. Per BleepingComputer's reporting of the advisory, the flaws are remotely exploitable by unauthenticated attackers through low-complexity attacks that require no user interaction.

AOS-10 is affected by CVE-2026-79844 (authentication bypass leading to RCE), CVE-2026-79845 (authentication bypass in the PAPI protocol), and CVE-2026-79847 and CVE-2026-79851 (unauthenticated buffer overflows leading to RCE). AOS-8 is affected by CVE-2026-79846 (unauthenticated command injection), CVE-2026-79848 and CVE-2026-79849 (unauthenticated SQL injection leading to RCE), and CVE-2026-79850 (authentication bypass leading to RCE). NVD records list CWE-288 (authentication bypass using an alternate path) for CVE-2026-79844 and CVE-2026-79850, CWE-89 for CVE-2026-79848 and CVE-2026-79849, and CWE-119 for CVE-2026-79847 and CVE-2026-79851. NVD lists CVSS 3.1 base score 10.0 for each (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H on the command injection, SQL injection and buffer overflow entries; the two CWE-288 entries carry A:N in the published vector). The NVD record for CVE-2026-79845 currently resolves to an unrelated third-party product (code-projects Simple Inventory System) and was not used for scoring or affected-version data; its PAPI authentication bypass classification comes from the HPE advisory as reported by BleepingComputer.

NVD affected ranges (product listed only as 'HPE Unknown') are AOS-10 10.3.0.0-10.4.1.13, 10.6.0.0-10.7.2.6 and 10.8.0.0-10.8.1.1, and AOS-8 8.10.0.0-8.10.0.23 and 8.12.0.0-8.13.3.0. Fixed version numbers, discoverer credit and per-CVE technical descriptions were not available in the sources reviewed (the HPE portal page returned no content to the fetcher). The attack surface is the CLI and web-based management interfaces and the PAPI protocol. HPE's mitigation guidance is to restrict CLI and web-based management interfaces to a dedicated layer 2 segment/VLAN and/or control them with layer 3 firewall policies. HPE states it is not aware of public discussion or exploit code for these issues as of release. Because ArubaOS controllers and gateways sit at the network edge and manage wireless infrastructure, a successful compromise would give an attacker a privileged foothold on network infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1556 Modify Authentication Process

## Sources

- [HPE patches eight max severity RCE and auth bypass AOS flaws](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/)
- [HPE Security Bulletin hpesbnw05162en_us](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US)
- [NVD CVE-2026-79844](https://nvd.nist.gov/vuln/detail/CVE-2026-79844)
- [NVD CVE-2026-79846](https://nvd.nist.gov/vuln/detail/CVE-2026-79846)
- [NVD CVE-2026-79847](https://nvd.nist.gov/vuln/detail/CVE-2026-79847)
- [NVD CVE-2026-79848](https://nvd.nist.gov/vuln/detail/CVE-2026-79848)
- [NVD CVE-2026-79849](https://nvd.nist.gov/vuln/detail/CVE-2026-79849)
- [NVD CVE-2026-79850](https://nvd.nist.gov/vuln/detail/CVE-2026-79850)
- [NVD CVE-2026-79851](https://nvd.nist.gov/vuln/detail/CVE-2026-79851)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4267