Security notice
Use Aruba Wi-Fi controllers or access points? HPE fixed critical flaws. Plan the update.
On October 22, 2026, HPE released fixes for 72 security flaws in AOS-8 and AOS-10, the operating systems that run HPE Aruba Networking wireless equipment: Mobility Conductors, Mobility Controllers, Mobility Gateways and access points. Eight of them are rated 10 out of 10, the highest score. HPE says they could let an attacker with no login run commands on the device or take administrative control of it. HPE says it is not aware of any public discussion or exploit code targeting them. None of this affects your website or online store directly. If you or an IT provider run this Aruba equipment, install the fixes in your next maintenance window, and keep the management screens off networks that strangers can reach until then.
What happened
HPE published security advisory HPESBNW05162 on Thursday, October 22, 2026, rated critical. It covers 72 CVEs in AOS-8 and AOS-10. HPE says most were found by its own security research, and some came in through its bug bounty program. (HPE advisory)
- Eight flaws rated 10.0. CVE-2026-79844 through CVE-2026-79851 are each rated 10.0 on the CVSS 3.1 scale, which describes an attack over the network that needs no login or user action and is not complex to carry out. HPE says seven of these eight could let an attacker run commands or code on the device's operating system. The eighth, CVE-2026-79845, could let an attacker get around the login and gain administrative access, change settings and read or change sensitive data. For two of them, CVE-2026-79844 and CVE-2026-79846, HPE says the attack only works "if certain preconditions outside of the attacker's control are met." (HPE advisory)
- Many more rated critical. Another 25 of the 72 are rated between 9.3 and 9.8. Some of those need the attacker to be on the same local network as the device rather than anywhere on the internet. The rest are rated lower, and some of those need a login. (HPE advisory)
- Not known to be exploited. HPE says it "is not aware of any public discussion or exploit code that targets the listed vulnerabilities as of the release date of this advisory." None of the 72 were on the US CISA list of known exploited flaws in the latest version we checked, dated October 26, 2026. HPE still says customers are "strongly urged to patch" because of "the complexity, breadth, and impact of these vulnerabilities." (HPE advisory, CISA, BleepingComputer)
Who should worry
This is not a problem with your website or online store, and your site visitors are not at risk from it. It is about the equipment that runs Wi-Fi in an office, shop, warehouse or campus. Most small businesses that use it have an IT provider or MSP looking after it.
Ask about this if any of these are true:
- Your Wi-Fi uses HPE Aruba Networking Mobility Controllers or a Mobility Conductor running AOS-8.
- Your Wi-Fi uses Aruba access points running AOS-10, or AOS-8 Instant access points.
- You use Aruba Mobility Gateways managed through HPE Aruba Networking Central.
- An IT provider or MSP manages Aruba wireless equipment for you.
HPE says products and versions not listed in its advisory are not affected. The list does not include the separate Aruba Instant On line for small businesses, or Aruba switches that run AOS-CX. (HPE advisory)
What to do now
Plan these for your next maintenance window.
- Ask the question. Send the message below to your IT provider, MSP or IT person. You need a clear yes or no: do we use Aruba equipment running AOS-8 or AOS-10, and when will it be on a fixed version?
- Update to a fixed release. AOS 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24, or newer, depending on which version you run. (HPE advisory)
- Lock down the management screens until then. HPE recommends limiting the command line and web management interfaces to a dedicated network segment (VLAN) or firewall rules, and logging who uses them. This lowers the risk but does not fix the flaws. (HPE advisory)
- If your next window is weeks away, ask whether this can go sooner. Eight of these flaws are rated 10.0, so it is worth asking, especially if any management screen can be reached from the internet or from a guest Wi-Fi network.
- If the answer is "I don't know", that is not a no. Ask them to check.
What to send your IT provider, MSP or IT person
On October 22, 2026, HPE published advisory HPESBNW05162, rated critical, fixing 72 CVEs in AOS-8 and AOS-10 for Mobility Conductors, Mobility Controllers, Mobility Gateways and access points. Eight are rated CVSS 10.0 (CVE-2026-79844 through CVE-2026-79851). HPE says it is not aware of public discussion or exploit code. Please confirm whether we use any of this equipment and which AOS version it runs. If we do, please schedule the fixed release (AOS 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24, or newer) in the next maintenance window, keep the CLI and web management interfaces restricted to a dedicated VLAN or firewall rules until then, and tell us when it is done. If any of it runs a version past end of maintenance, please tell us the plan to move it to a supported release. Source: HPE advisory HPESBNW05162.
Technical steps
Step 1. Check the AOS version
Affected: AOS 10.8.1.1 and below, 10.7.2.6 and below, 10.4.1.13 and below, 8.13.3.0 and below, and 8.10.0.23 and below. This covers Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Aruba Networking Central, AOS-10 access points and AOS-8 Instant access points. (HPE advisory)
Step 2. Upgrade
AOS-10.8: 10.8.1.2 or above. AOS-10.7: 10.7.2.7 or above. AOS-10.4: 10.4.1.14 or above. AOS-8.13: 8.13.3.1 or above. AOS-8.10: 8.10.0.24 or above. HPE says fixed software is on the HPE Networking Support Portal. (HPE advisory)
Step 3. Older versions
HPE says versions past End of Maintenance are presumed affected and are not covered by the advisory, and it has not assessed versions past End of Support, so treat those as affected too. HPE strongly encourages moving to a supported release. (HPE advisory)
Step 4. Until you can patch
Restrict the CLI and web based management interfaces to a dedicated layer 2 segment or VLAN, or control them with firewall policies at layer 3 and above, with accounting controls that log user activity, as HPE recommends. That narrows the risk but does not close the flaws. (HPE advisory)
Common questions
Has my business been hacked?
This notice does not mean your business has been hacked. HPE says it is not aware of any public discussion or exploit code for these flaws, and they were not on the US CISA list of known exploited flaws in the latest version we checked, dated October 26, 2026. (HPE advisory, CISA) That can change, which is why the fixes are worth scheduling now.
Can EverThread tell me if I am affected?
No. EverThread checks websites from the outside, the way a browser sees them. We do not test for these Aruba flaws, and we do not scan Wi-Fi controllers, gateways or access points, so we cannot tell whether yours are on a fixed version. Whoever manages your Wi-Fi equipment can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
We use Aruba Instant On. Do we need to do anything for this advisory?
HPE's advisory does not list Aruba Instant On, and HPE says products not listed are not affected. Keep Instant On devices updated as usual. (HPE advisory)
Why is this not marked "update today" like other notices?
Because the facts are different. HPE found most of these itself, says it knows of no public exploit code, and they do not touch your website or store. The fixes still matter, and some are rated 10 out of 10, so schedule them and lock down the management screens, but there is no sign of attacks to rush ahead of.
Where can I follow official updates?
HPE's advisory HPESBNW05162 has a revision history that shows any changes.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- HPE Networking: Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-8 and AOS-10) for Mobility Conductors, Controllers, Gateways, and Access Points (HPESBNW05162), October 22, 2026
- BleepingComputer: HPE patches eight max severity RCE and auth bypass AOS flaws, October 23, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 26, 2026, checked October 27, 2026