CVE-2026-79844CVSS 10AOS-10 authentication bypass to RCE
Some preconditions outside attacker control are unspecified.
HPE patches 72 ArubaOS vulnerabilities, including eight CVSS 10 authentication bypass and RCE flaws
HPE bulletin HPESBNW05162 fixes 72 CVEs across AOS-8 and AOS-10. Eight score CVSS 10.0; attacks include unauthenticated management and PAPI paths. HPE reports no known public exploit code at disclosure.
- Disclosed
- Oct 22, 2026
- Public disclosure date
- Severity
- CVSS 10 × 8
- 8 CVEs tracked here
- Splash zone
- Reachable AOS-8 / AOS-10 interfaces; some RCE paths have unspecified preconditions outside attacker control
- HPE · ArubaOS · RCE
- In the wild
- Unknown
- HPE reports no known public exploit code; the advisory does not establish exploitation
What happened
This is an urgent L3 patch batch for enterprise wireless infrastructure. Impact depends on the interface and product: some paths require adjacent access or privileges, while the eight maximum-score CVEs include unauthenticated network attacks. HPE leaves certain prerequisites unspecified; a severity score alone does not prove every deployment is remotely exploitable.
The table lists the eight CVSS 10.0 entries, not all 72. Other HPE products are outside this bulletin; unsupported AOS releases still require attention. This is separate from HPE’s ClearPass PHP2Shell advisory.
What’s in the bowl
CVE-2026-79845CVSS 10AOS-10 PAPI authentication bypass
Unauthenticated access can grant administrative control.
CVE-2026-79846CVSS 10AOS-8 command injection
Some preconditions outside attacker control are unspecified.
CVE-2026-79847CVSS 10AOS-10 buffer overflow
Crafted packets can execute privileged code.
CVE-2026-79848CVSS 10AOS-8 SQL injection to RCE
Unauthenticated SQL injection can execute operating-system commands.
CVE-2026-79849CVSS 10AOS-8 SQL injection to RCE
Unauthenticated SQL injection can execute operating-system commands.
CVE-2026-79850CVSS 10AOS-8 authentication bypass to RCE
Unauthenticated bypass can execute commands as root.
CVE-2026-79851CVSS 10AOS-10 buffer overflow
Unauthenticated input can execute privileged code.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| AOS-10.8 | 10.8.1.2 | Patched |
| AOS-10.7 | 10.7.2.7 | Patched |
| AOS-10.4 | 10.4.1.14 | Patched |
| AOS-8.13 | 8.13.3.1 | Patched |
| AOS-8.10 | 8.10.0.24 | Patched |
Crime-scene timeline
Oct 22, 2026
HPE publishes HPESBNW05162 revision 1
Fixes cover 72 CVEs; the eight maximum-score issues are listed here.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- HPE HPESBNW05162 signed textPrimaryOriginal vendor bulletin: CVEs, prerequisites, fixed releases and mitigations
- HPE support portalCanonical bulletin page; signed text read because portal did not render
- Canadian Centre for Cyber Security AV26-1079October 22 notice independently lists the same five version thresholds