Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE
In October 2026, Hewlett Packard Enterprise released emergency security patches addressing 72 vulnerabilities in ArubaOS (AOS), the operating system powering Aruba Networking enterprise wireless infrastructure including mobility conductors, access points, controllers, and gateway devices. Eight of these flaws carry maximum CVSS severity scores and enable unauthenticated remote code execution and authentication bypass across both AOS-8 and AOS-10 software versions. The vulnerabilities—spanning command injection, SQL injection, and buffer overflow vectors—require no privileges and no user interaction, making them trivially exploitable at scale across HPE's installed base of over 55,000 enterprise customers, including 90% of Fortune 500 companies. HPE confirmed no active exploitation or public proof-of-concept code existed at time of disclosure. This disclosure follows a pattern of critical HPE network infrastructure vulnerabilities in 2025–2026, including StoreOnce auth bypass flaws, hardcoded Aruba credentials, and actively exploited HPE OneView weaknesses flagged by CISA. Attackers increasingly target network infrastructure operating systems as a high-leverage initial access vector, making unpatched edge devices a primary risk surface for enterprise environments.
Kill Chain
