Hewlett Packard Enterprise (HPE) has issued security patches targeting 72 vulnerabilities across the Aruba Operating System (ArubaOS), with eight of those flaws rated at maximum severity. The affected software powers Aruba Networking's enterprise wireless infrastructure, encompassing mobility conductors, access points, controllers, and gateway devices.

The eight critical vulnerabilities impact multiple versions of AOS-8 and AOS-10. Each can be exploited remotely by unauthenticated attackers through low-complexity methods requiring no user interaction.

Critical flaws identified

  • Authentication Bypass Leading to RCE in AOS-10
  • Authentication Bypass in the PAPI Protocol of AOS-10
  • Unauthenticated Command Injection in AOS-8
  • Unauthenticated Buffer Overflow leads to RCE in AOS-10
  • Unauthenticated SQL Injection leading to RCE in AOS-8
  • Authentication Bypass leading to RCE in AOS-8
  • Unauthenticated Buffer Overflow leading to RCE in AOS-10

Mitigation and urgency

HPE has urged immediate patching and outlined defensive measures to reduce exploitation risk. The vendor recommends isolating command-line and web-based management interfaces to a dedicated layer 2 segment or VLAN, and applying firewall policies at layer 3 and above. Additionally, accounting controls should track and log user activities and resource usage.

Customers are strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities

HPE, in a Thursday security advisory

To minimize the likelihood of an attacker exploiting these vulnerabilities, HPE Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above along with accounting controls for tracking and logging user activities and resource usage.

HPE Networking

Current exploitation status

As of the advisory release, HPE stated it has not identified any publicly disclosed proof-of-concept exploits or active exploitation attempts targeting these flaws. "HPE Networking is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory," the company said.

Pattern of recent HPE security issues

This patch cycle reflects an ongoing pattern of significant vulnerabilities across HPE's product portfolio. In June 2025, the company addressed eight critical StoreOnce vulnerabilities enabling authentication bypass and remote code execution. The following month, HPE disclosed hardcoded credentials in Aruba Instant On Access Points that could allow attackers to circumvent device authentication.

In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified a maximum-severity HPE OneView vulnerability as being actively exploited. More recently, HPE warned of critical flaws on unpatched AOS-CX devices that permit administrative password resets and remote code execution.

HPE operates globally with more than 61,000 employees and serves over 55,000 enterprise customers worldwide, including 90% of Fortune 500 companies.