Hewlett Packard Enterprise (HPE) has released security patches to address 72 vulnerabilities in its Aruba networking products, specifically targeting the AOS-8 and AOS-10 wireless operating systems. This update includes fixes for 33 critical-severity flaws, among which eight have been identified as maximum severity. These critical vulnerabilities, if exploited, could allow attackers to execute remote code, bypass authentication, gain administrative privileges, and fully compromise affected systems without any prior access.

The specific vulnerabilities addressed are cataloged as CVE-2026-79844 through CVE-2026-79851. HPE has confirmed that versions 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, and 10.8.1.2 of the AOS software now incorporate these security patches. These updates have been deployed across several product lines, including mobility conductors, controllers, gateways, and access points.

In addition to the critical vulnerabilities, HPE has fixed 31 high-severity vulnerabilities, many of which could be exploited without authentication, along with eight medium-severity flaws and one low-severity issue. HPE emphasizes that all hardware, mobility solutions such as conductors, controllers, and gateways, and virtual machines compatible with the vulnerable operating systems are susceptible to these security risks.

HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, supported by firewall policies at layer 3 and above. This should help minimize the risk of exploitation. While there are no known cases of these vulnerabilities being exploited in the wild, HPE urges all customers to apply these patches promptly to safeguard their systems.