HPE patches 72 ArubaOS flaws, including eight rated at maximum severity

A large advisory with a consequential subset

BleepingComputer reports that HPE patched 72 ArubaOS vulnerabilities, including eight maximum-severity issues. The total and the subset answer different questions. Teams should not describe every issue in the advisory as having the maximum rating.

According to BleepingComputer, the eight maximum-severity flaws can be attacked remotely without privileges or user interaction. Those prerequisites are a reason to prioritise an applicability review. They do not establish that malicious actors have exploited a particular organisation’s equipment.

BleepingComputer lists CVE-2026-79844 as an authentication bypass leading to remote code execution in AOS-10. The product context belongs with the vulnerability description. A broad headline about wireless infrastructure should not erase the need to identify the deployed software.

Brandefense identifies CVE-2026-79844 through CVE-2026-79851 as the eight CVSS 10.0 flaws. That range helps connect the reported maximum-severity subset to individual identifiers. It should not substitute for a product-by-product applicability check.

Start with the equipment and its release train

HPE’s advisory covers wireless products including Mobility Conductors, Controllers, Gateways and Access Points. This scope makes the inventory task broader than looking for one device label. Administrators should record the actual product and software train before choosing a destination release.

For a specific train, HPE lists 10.8.1.2 and above as fixed versions for AOS-10.8.x.x. Preserve the train qualification. A fixed version for that branch is not a universal destination for all devices described in the advisory.

Brandefense lists 8.13.3.1 and 8.10.0.24 among fixed release versions. These are alternatives associated with different trains, not successive steps that every installation must follow. A useful change record should state which installed branch is being addressed and why the chosen update applies.

HPE says the vulnerabilities were generally discovered through its own internal security research. This describes the disclosure’s research context. Neither the maximum score nor internal discovery should be turned into an unsupported claim of active exploitation or public exploit availability.

A conditional review for Algerian network operators

The Algeria connection is practical for organisations that actually use the affected products. These facts do not establish local deployments or victims. An Algerian network team should first determine whether the advisory applies, rather than assume that all wireless infrastructure is affected.

Build the decision around product, installed train, applicable fixed release and change owner. Review which management interfaces are reachable and who is authorised to use them. Those are sensible assessment questions prompted by remotely attackable flaws, not findings about a particular Algerian network.

Prepare a change plan that names the equipment being updated and how service will be checked afterwards. Where the branch or product is uncertain, resolve that inventory gap before treating the remediation as complete.

The useful output is an applicability map

The headline establishes a reason to act, while release details determine the action. Keep the maximum-severity subset, affected product scope and train-specific versions together in the internal briefing. The result should be a documented update decision for actual equipment, without inventing evidence of exploitation.

Frequently Asked Questions

Sources & Further Reading

• BleepingComputer
• HPE Networking
• Brandefense
• NewsBites Volume XXVIII – Issue 80, October 27, 2026 | SANS NewsBites — SANS Institute