Executive Summary

On October 22nd, 2026, Hewlett Packard Enterprise (HPE) disclosed a critical vulnerability in AOS-10, the operating system for its Aruba Networking wireless infrastructure. Tracked as CVE-2026-79844, the flaw lets an unauthenticated, remote attacker bypass authentication and execute code on an affected device. AOS-10 releases up to 10.8.1.1, 10.7.2.6, and 10.4.1.13 are affected.

AOS, also known as ArubaOS, runs the mobility conductors, controllers, gateways, and access points that carry enterprise wireless traffic. The flaw is one of eight critical authentication bypass and code execution issues in an HPE release that fixes 72 vulnerabilities across AOS-8 and AOS-10. HPE has also recently warned of critical flaws in its AOS-CX devices that allow admin password resets and remote code execution.

HPE reported no public exploit code or known exploitation as of its advisory release, and none is known at the time of writing. Given unauthenticated network reach, code execution on network infrastructure, and the number of critical flaws fixed in the same release, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Product

Affected Versions

Fixed Versions

HPE Aruba Networking AOS-10 10.8

10.8.1.1 and earlier

See HPE security advisory

HPE Aruba Networking AOS-10 10.7

10.7.2.6 and earlier

See HPE security advisory

HPE Aruba Networking AOS-10 10.4

10.4.1.13 and earlier

See HPE security advisory

Mitigations / Workarounds

HPE urges customers to upgrade to a fixed release, citing the complexity, breadth, and impact of the vulnerabilities in this release. To reduce the likelihood of exploitation, HPE recommends restricting access to the AOS management interfaces. HPE gives this guidance for the release as a whole and has not stated that it fully mitigates CVE-2026-79844.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

  • Restrict the AOS CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, as HPE recommends.

  • Control access to those management interfaces with firewall policies at layer 3 and above, and allow only trusted administrative hosts.

  • Enable accounting controls to track and log user activity and resource usage, and review those logs for administrative sessions your team did not initiate.

Patches

HPE has released AOS-10 software updates that address CVE-2026-79844 as part of its October 22nd, 2026 security advisory, which also covers vulnerabilities in AOS-8.

Technical Details

HPE describes CVE-2026-79844 as an authentication bypass leading to remote code execution (RCE) in AOS-10. The CVE record classifies it as authentication bypass using an alternate path or channel (CWE-288). At the time of writing, the NVD record carries no description, and the affected AOS-10 service or interface has not been publicly identified.

The flaw is reachable over the network with low attack complexity, and exploitation needs no authentication and no user interaction. At the time of writing, no public proof-of-concept (PoC) is known.

The same HPE release fixes seven other critical authentication bypass, injection, and buffer overflow flaws across AOS-8 and AOS-10. No source links them to CVE-2026-79844 or reports them exploited.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.

Sources