Hewlett Packard Enterprise has issued security updates addressing 72 vulnerabilities in the Aruba Operating System, including eight flaws rated maximum severity that allow authentication bypass and code execution. ArubaOS, also called AOS, runs Aruba Networking's enterprise wireless infrastructure, which includes mobility conductors, access points, controllers and gateway devices. The eight most serious flaws affect multiple versions of AOS-8 and AOS-10. HPE said remote attackers could exploit them without any privileges, using low-complexity attacks that require no user interaction.
HPE urged customers to apply the patches as soon as possible and issued mitigation measures in a Thursday security advisory. The company said the complexity, breadth and impact of the vulnerabilities were the reason for its strong recommendation to patch. HPE Networking advised restricting the command-line and web-based management interfaces to a dedicated layer 2 segment or VLAN, or controlling them with firewall policies at layer 3 and above. It also recommended accounting controls to track and log user activity and resource usage.
According to HPE, it has not found publicly available proof-of-concept exploit code for the flaws or any evidence that they have been exploited in attacks. The company said that, as of the advisory's release date, it was not aware of any public discussion or exploit code targeting the listed vulnerabilities.
The ArubaOS fixes follow a series of recent HPE security advisories. In June 2025, HPE patched eight critical StoreOnce vulnerabilities that allowed authentication bypass and remote code execution. One month later, the company warned of hardcoded credentials in Aruba Instant On Access Points that could let attackers bypass device authentication. In January 2025, the U.S. Cybersecurity and Infrastructure Security Agency flagged a maximum-severity HPE OneView vulnerability as exploited in attacks. More recently, HPE warned of critical flaws that allow admin password resets and remote code execution on unpatched AOS-CX devices.
HPE employs more than 61,000 people worldwide and provides services and products to over 55,000 enterprise customers, including 90% of Fortune 500 companies. The company's networking gear is widely deployed in U.S. enterprise environments, where the management interfaces targeted by these flaws are typically reachable from internal networks.
Overall prevention scores can obscure what happens after an attacker gains initial access. Once valid credentials are in use, prevention rates drop sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations conducted in customer production environments.
More cybersecurity news from TechManNews.
