HPE Networking has released advisory HPESBNW05162, which fixes 72 vulnerabilities in the AOS-8 and AOS-10 operating systems that run Aruba wireless Mobility Conductors, Controllers, Gateways and Access Points. Of the 72, 34 are critical and eight carry the maximum CVSS score of 10.0.
Breakdown of the 72 Vulnerabilities by Severity and Reach
According to CVSS data, 58 of the 72 flaws need no login. Thirty-two are reachable over the network, and 25 require adjacent network access. Adjacent-network critical bugs rate 9.6.
Most of the high and critical flaws allow arbitrary code execution as a privileged user. Two administrator-level flaws can crash a device so that it cannot reboot without manual intervention.
PAPI Command Injection and Memory Bugs
Many of the bugs sit in PAPI, the protocol used to manage access points, which listens on UDP port 8211. They include command injection, with CVE-2026-79857 in AOS-8 and CVE-2026-79861 in AOS-10 as examples, as well as buffer overflows, login bypass, SQL injection, file writes and path traversal.
SSH Daemon Authentication Bypass in CVE-2026-79855
The advisory also includes CVE-2026-79855, an authentication bypass in the SSH daemon. It joins the PAPI flaws as a way to gain access to the management plane of the wireless infrastructure without valid credentials.
Fixed Releases Across Both Operating Systems
HPE fixed the flaws in AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14 for AOS-10, and in AOS-8.13.3.1 and 8.10.0.24 for AOS-8. The number of fixed lines reflects the range of release trains HPE supports for the Aruba wireless platform.
HPE has reported no exploitation and no public proof-of-concept code, and none of the vulnerabilities is in the CISA Known Exploited Vulnerabilities catalog.
How the Bugs Were Found
Most of the vulnerabilities were found internally. The advisory credits Bugcrowd researchers moonv, LIUPENG and zzcentury, along with Diego Gomez, David Kierznowski and a team from Siemens Energy.
Where the Exposure Falls for Enterprise Wi-Fi
The Aruba products affected make up the wireless networks of offices, campuses and hospitals. Control of a controller or gateway could let an attacker watch or redirect traffic passing through the network. The flaws in PAPI are notable because the protocol is the channel by which the wireless infrastructure itself is managed.
The adjacent-network requirement for 25 of the flaws means an attacker would need a position on the local network segment, such as a connected device or a compromised host, while the 32 network-reachable bugs do not carry that limit. The advisory’s count of 58 flaws that need no login shows how large the unauthenticated share is.
Interim Controls Listed for Management Interfaces
For systems that cannot be upgraded immediately, the guidance points to restricting management interfaces to a dedicated layer 2 segment or applying firewall policy, and to logging activity on those interfaces.
Timing of the HPESBNW05162 Advisory and Open Details
The coverage appeared on October 23, and the exact advisory date was not stated, with the patches and advisory released around October 22. The advisory spans five fixed releases across two operating system families, so administrators running both AOS-8 and AOS-10 need to match each device to the right train.
Device Crashes That Need Manual Recovery
Two of the administrator-level flaws can leave a device unable to reboot without manual intervention. In a campus or hospital deployment with access points spread across many buildings, a device that cannot restart on its own means a person has to visit it, which turns a software flaw into a physical maintenance problem.
Scope of the Product Family
The advisory covers Mobility Conductors, Controllers, Gateways and Access Points, which together make up the management and radio layers of an Aruba wireless network. The count of 34 critical flaws across that range, with eight at the maximum score, is the headline figure, while the 58 flaws needing no login describe how many of them an attacker could try without credentials.
