"Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities," HPE warned in a Thursday security advisory.
What HPE patched: 72 vulnerabilities, eight at maximum severity
Hewlett Packard Enterprise released security updates addressing 72 vulnerabilities in the Aruba Operating System (ArubaOS, or AOS). Among those fixes are eight vulnerabilities HPE rated maximum severity for authentication bypass and remote code execution. According to the advisory, the eight maximum-severity flaws affect multiple AOS‑8 and AOS‑10 software versions.
How the most serious flaws can be exploited
HPE said the maximum-severity issues can be exploited by remote threat actors without privileges through low-complexity attacks that do not require user interaction. The company provided a full list of the maximum-severity flaws in a table embedded in the advisory and urged customers to apply the updates as soon as possible.
At the same time, HPE reported it had not found publicly available proof-of-concept exploit code or evidence that these vulnerabilities are being exploited in the wild. "HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory," the company said.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAffected products: ArubaOS across enterprise wireless infrastructure
ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices. The advisory specifically calls out AOS‑8 and AOS‑10 versions as impacted by the maximum-severity flaws. HPE also noted other recent issues in its product portfolio, including earlier patches and warnings in 2025 — for example, StoreOnce fixes in June 2025, a warning about hardcoded credentials in Aruba Instant On Access Points the following month, and a maximum‑severity HPE OneView vulnerability flagged by the U.S. Cybersecurity and Infrastructure Security Agency in January 2025.
HPE's mitigations: restrict management interfaces and add accounting controls
Alongside software updates, HPE recommended mitigation measures intended to reduce the likelihood of exploitation while customers patch. The company advised that "the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage." Those controls are offered as ways to limit direct exposure of AOS management interfaces and to augment visibility into administrative activity.
What this means for technologists, procurement teams, and adversaries
- Technologists and security teams: HPE's advisory directs immediate patching of affected AOS instances and the recommended network segmentation and firewall rules for management interfaces. The advisory's emphasis on accounting controls highlights the need to track and log administrative activity for detection and forensic purposes.
- Procurement and enterprise IT leaders: HPE serves a broad customer base — the company "employs more than 61,000 people worldwide and provides services and products to over 55,000 enterprise customers worldwide, including 90% of Fortune 500 companies" — which underscores the scale of organizations that should inventory and prioritize ArubaOS devices across AOS‑8 and AOS‑10 versions for remediation.
- Adversaries and threat actors: Although HPE reported no known public exploit code or ongoing exploitation, the advisory makes clear the vulnerabilities are remotely exploitable without credentials. That combination — high severity, low complexity exploitability, and broad product footprint — is the sort of condition adversaries monitor closely.
HPE's warning and the mitigation guidance land against a backdrop of broader defensive findings: the Blue Report 2026, cited in the advisory, notes that "overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The report measures defenses technique by technique across "338 million simulations run in customer production environments," a statistic HPE included to underline the challenge of stopping attackers after initial compromise.
HPE's message is unambiguous: apply the updates, restrict access to management interfaces, and add logging and accounting controls. The advisory leaves open how quickly large deployments will be patched, but the company’s explicit urging — and the technical details about remote, low-complexity exploitability — make the practical next step for affected organizations straightforward.
Original advisory: https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
