HPE releases ArubaOS fixes for dozens of flaws, eight rated most severe
HPE has issued updates for ArubaOS that address 72 security bugs, eight of which are rated maximum severity and involve authentication bypass or remote code execution. The most serious issues affect several AOS-8 and AOS-10 releases and can be exploited remotely without credentials or user action. HPE advises customers to install the patches promptly and limit management interface exposure; it says it has not seen public exploit code or active attacks.
The advisory covers 72 ArubaOS vulnerabilities, with eight rated highest severity. Those eight span AOS-8 and AOS-10 and include authentication bypass, command injection, buffer overflow, and SQL injection issues that can lead to remote code execution. HPE says they are remotely exploitable without credentials or user interaction and are low complexity.
ArubaOS runs enterprise wireless gear such as controllers, access points, gateways, and mobility conductors. HPE recommends prompt patching and limiting CLI and web management access to a dedicated Layer 2 segment/VLAN or firewall-controlled Layer 3+ paths, plus accounting controls. It reports no known public exploit code or active attacks.
Organizations using ArubaOS for enterprise wireless networks could face elevated risk if management interfaces remain exposed, because flaws that bypass authentication or enable remote code execution may let attackers gain control of network infrastructure. That could disrupt connectivity, expose data traversing wireless systems, or provide a foothold for further intrusion. Patching and restricting management access may reduce exposure, but the practical impact depends on how quickly affected controllers, gateways, and access points are updated.