HPESBNW05162, HPE Networking (Aruba) AOS-8 and AOS-10 wireless: 72 CVEs fixed in one bulletin, 19 of them unauthenticated and network-reachable at CVSS 9.0 or above, across controllers, gateways and access points
HPE's Aruba wireless bulletin fixes 19 unauthenticated network flaws at CVSS 9.0+; HPE knows of no public exploit code
Defender actions
- Upgrade every HPE Networking (Aruba) Mobility Conductor, Controller, Gateway and access point on AOS-10 or AOS-8 to the fixed build of its train (10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24), and until then confine the CLI and web management interfaces to a dedicated layer 2 segment or VLAN behind firewall policy, as HPE advises.
Analysis
HPE Networking's bulletin HPESBNW05162 (initial release 2026-10-22) fixes 72 CVEs in the wireless operating systems AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways managed by HPE Networking Central, AOS-10 access points (AOS-AP) and AOS-8 Instant access points (AOS-IAP) (HPE Networking, 2026-10-22). By the CSAF's CVSS 3.1 scores, 34 of the 72 rate 9.0 or higher (eight at 10.0, ten at 9.8, eleven at 9.6, one at 9.4 and four at 9.3); the 19 rated 10.0, 9.8 or 9.4 need network access and no privileges, and the other 15 are reachable from the adjacent network (HPE Networking CSAF, 2026-10-22). The named mechanisms include authentication bypasses and command injection in the AOS-10 interface and in the PAPI protocol, a buffer overflow and a command injection in the AOS-8 PAPI protocol that arrive as crafted packets on its UDP port, an authentication bypass in the AOS-8 SSH daemon, and SQL injection in the web-based management interface (HPE Networking CSAF, 2026-10-22). HPE says the flaws were generally found by its internal security research, that it is not aware of public discussion or exploit code as of the release, and that customers are strongly urged to patch; for some of the critical rows exploitation also needs preconditions outside the attacker's control, which the bulletin does not itemise (HPE Networking, 2026-10-22)(HPE Networking CSAF, 2026-10-22).
The bulletin text names AOS-10 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6 and 10.4.x up to 10.4.1.13, and AOS-8 8.13.x up to 8.13.3.0 and 8.10.x up to 8.10.0.23, while the machine-readable CSAF lists wider known-affected ranges, AOS-10 10.8.0.0 to 10.8.1.1, 10.6.0.0 to 10.7.2.6 and 10.3.0.0 to 10.4.1.13, and AOS-8 8.12.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23, which take in the 10.6, 10.3 and 8.12 branches the text omits, so treat the CSAF ranges as the scope; fixed builds are AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14 and AOS-8.13.3.1 and 8.10.0.24 (HPE Networking, 2026-10-22)(HPE Networking CSAF, 2026-10-22). HPE's workaround is to restrict the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, controlled by firewall policies at layer 3 and above with accounting controls (HPE Networking, 2026-10-22).
Cited evidence
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met.
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.