HPE Aruba patches 72 vulnerabilities in wireless operating systems including eight CVSS 10.0 RCE flaws

HPE Aruba resolves 72 wireless flaws including eight CVSS 10.0 bugs threatening campus network controllers

Hewlett Packard Enterprise has published a massive security bulletin, designated HPESBNW05162, resolving 72 security vulnerabilities across its flagship enterprise wireless networking platforms, ArubaOS 8 (AOS-8) and ArubaOS 10 (AOS-10). The advisory represents one of the largest single security updates in enterprise wireless history, affecting mobility conductors, hardware mobility controllers, cloud-managed gateways, and campus access points deployed across corporate campuses, healthcare institutions, and educational facilities worldwide. Out of the 72 disclosed vulnerabilities, 64 flaws (88.9 percent, derived) are classified as Critical or High severity, with eight distinct vulnerabilities evaluated at the maximum possible severity rating of CVSSv3.1 score 10.0 out of 10.0.

The eight CVSS 10.0 vulnerabilities enable unauthenticated remote code execution (RCE), command injection, and complete authentication bypass across core control plane daemons and administrative web consoles. Most critically, several flaws weaponize Aruba's proprietary Process Application Programming Interface (PAPI) protocol, which communicates over UDP port 8211. An unauthenticated attacker capable of routing packets to vulnerable controllers or access points can forge control messages, trigger memory corruption, or execute arbitrary system commands with root privileges, seizing control of campus wireless infrastructure without possessing valid administrative credentials.

Audit of verified technical disclosures versus operational assumptions

To evaluate enterprise exposure following the HPESBNW05162 disclosure, security architects must examine verified engineering telemetry published by HPE Aruba against operational assumptions regarding wireless controller isolation.

Audit of verified technical disclosures in HPE Advisory HPESBNW05162 versus operational assumptions

Advisory Dimension	Explicitly Verified in HPE Aruba Bulletin HPESBNW05162	Unverified or Dependent on Deployment Architecture
Vulnerability Scope	72 distinct CVEs resolved: 32 Critical, 32 High, 7 Medium, and 1 Low severity flaw.	The total count of internet-exposed versus purely internal campus controller endpoints worldwide.
Maximum Severity	8 flaws rated CVSS 10.0: 4 impacting AOS-10 and 4 impacting AOS-8 operating systems.	Whether threat actors have begun automated mass reverse engineering of the firmware binaries.
Attack Vectors	PAPI protocol on UDP port 8211 and web management console on HTTPS port 4343.	Whether local network microsegmentation effectively blocks inter-VLAN UDP 8211 traffic.
Exploitation Status	HPE confirmed zero public exploit code and zero active exploitation in the wild at disclosure.	The time window remaining before weaponized proof-of-concept scripts appear in public repositories.
Discovery Attribution	Flaws discovered through internal HPE security research and external bug bounty submissions.	Whether state-sponsored advanced persistent threat units possessed private pre-patch zero-days.
Interim Mitigation	Restricting management interfaces to dedicated Layer 2 VLANs and blocking UDP port 8211.	The operational feasibility of isolating PAPI in distributed multi-campus branch deployments.

The eight CVSS 10.0 vulnerabilities: forensic breakdown of maximum-severity bugs

The core of advisory HPESBNW05162 centres on eight vulnerabilities evaluated at the theoretical maximum severity score of 10.0. These flaws span both current AOS-10 cloud-managed deployments and legacy AOS-8 campus controller architectures:

Detailed forensic taxonomy of the eight CVSS 10.0 vulnerabilities in HPE Aruba Networking AOS-8 and AOS-10

CVE Identifier	Target Platform	Network Protocol & Port	Vulnerability Mechanism	Forensic Exploitation Impact
CVE-2026-79844	AOS-10	HTTPS (TCP 4343)	Authentication Bypass	Unauthenticated remote code execution via crafted management API requests.
CVE-2026-79845	AOS-10	PAPI (UDP 8211)	Protocol Auth Bypass	Arbitrary command execution via forged control plane packets without credentials.
CVE-2026-79846	AOS-8	Management Interface	Command Injection	Arbitrary shell command execution as root on mobility conductors and controllers.
CVE-2026-79847	AOS-10	Network Daemon	Buffer Overflow	Memory corruption leading to unauthenticated remote code execution on gateways.
CVE-2026-79848	AOS-8	Web UI (HTTPS 4343)	SQL Injection	Unauthenticated SQL injection leading to remote code execution and session compromise.
CVE-2026-79849	AOS-8	Web UI (HTTPS 4343)	SQL Injection	Secondary unauthenticated SQL injection permitting database and system takeover.
CVE-2026-79850	AOS-8	Management Portal	Authentication Bypass	Complete bypass of administrative login boundaries granting privileged console shell.
CVE-2026-79851	AOS-10	Service Daemon	Buffer Overflow	Heap corruption enabling unauthenticated remote code execution on campus access points.

The friendly-name fallacy: why wireless perimeter trust models collapse under PAPI exploitation

Enterprise security teams frequently succumb to a pervasive friendly-name fallacy: the assumption that Wi-Fi network hardware represents passive packet forwarders rather than full-fledged Linux compute nodes managing critical corporate traffic. Mobility Conductors (formerly known as Mobility Masters) and Mobility Controllers aggregate decrypted user traffic, enforce 802.1X enterprise authentication, and manage encryption keys for thousands of simultaneous mobile devices. Gaining root execution on a wireless controller compromises the entire Layer 2 and Layer 3 security posture of the enterprise, allowing attackers to manipulate network routing, capture credentials, and inject rogue configurations across all attached access points.

Zoom

The architectural crisis revealed by bulletin HPESBNW05162 stems from the dual exposure of administrative web services and proprietary control protocols. While web portals operating on TCP port 4343 are vulnerable to classic memory corruption and SQL injection flaws (such as CVE-2026-79848 and CVE-2026-79849), the control plane protocol vulnerabilities (CVE-2026-79845) represent a far more insidious threat. Because PAPI traffic on UDP port 8211 is routinely permitted across campus subnets to allow access points to communicate with centralized conductors, attackers on unprivileged user VLANs or adjacent branch networks can reach the PAPI daemon directly.

Technical anatomy of Aruba PAPI: how UDP port 8211 enables control plane hijacking

Aruba's Process Application Programming Interface (PAPI) is a proprietary, UDP-based messaging protocol designed in the early 2000s to coordinate real-time management events, configuration syncing, and telemetry between Aruba access points and central mobility controllers. By default, PAPI listens on UDP port 8211. In traditional Aruba architectures, PAPI messages encapsulate critical operational tasks, including AP heartbeats, radio resource management, and configuration provisioning.

Historically, PAPI relied on a shared, global MD5-hashed secret key (frequently defaulting to aruba123 in older documentation), rendering packet inspection vulnerable to tampering. In modern AOS-8 and AOS-10 implementations, PAPI includes session-handling logic to authenticate connecting network nodes. However, vulnerability CVE-2026-79845 exposes a catastrophic authentication bypass in the PAPI packet handler: incoming UDP packets crafted with specific opcode headers can bypass credential validation routines entirely.

# Conceptual representation of unauthenticated PAPI packet injection
# Demonstrating control plane UDP datagram structure on port 8211
import socket

PAPI_PORT = 8211
TARGET_CONTROLLER_IP = '10.100.1.10'

def construct_papi_control_packet():
    # PAPI Header Structure: magic byte (0x494e), opcode, sequence ID
    magic_header = b'\x49\x4e\x00\x01'
    opcode_admin_exec = b'\x00\x24'
    session_token_bypass = b'\x00' * 16
    
    # Injected administrative shell command payload
    cmd_payload = b'/bin/sh -c "id > /tmp/papi_pwn.txt"'
    payload_len = len(cmd_payload).to_bytes(2, byteorder='big')
    
    packet = magic_header + opcode_admin_exec + session_token_bypass + payload_len + cmd_payload
    return packet

# Transmission over unauthenticated UDP datagram socket
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(construct_papi_control_packet(), (TARGET_CONTROLLER_IP, PAPI_PORT))
print(f'[+] Injected PAPI control packet to (TARGET_CONTROLLER_IP):(PAPI_PORT)')

When the vulnerable PAPI daemon on a Mobility Conductor processes this forged packet, it interprets the payload as an authorized internal inter-process communication (IPC) directive. Because the daemon executes with root privileges to configure low-level wireless interfaces and firewall tables, the injected command executes in the context of the root user, handing complete administrative compromise to the attacker.

Firmware remediation matrix: verified target versions and interim mitigations

HPE Aruba has released patched firmware builds across all supported release trains. Because exploitation requires zero authentication, administrators must upgrade all mobility controllers and cloud-managed gateways immediately according to the following firmware matrix:

HPE Aruba Networking official patch resolution matrix for advisory HPESBNW05162

Software Train	Vulnerable Firmware Builds	Patched Firmware Release	Recommended Defensive Action
AOS-10.8	AOS-10.8.1.1 and earlier builds	AOS-10.8.1.2 (or later)	Immediate firmware upgrade via HPE Networking Central or manual package load.
AOS-10.7	AOS-10.7.2.6 and earlier builds	AOS-10.7.2.7 (or later)	Apply update immediately; verify PAPI port filtering across all managed AP groups.
AOS-10.4 (LSR)	AOS-10.4.1.13 and earlier builds	AOS-10.4.1.14 (or later)	Long-Supported Release update; mandatory upgrade for enterprise campus deployments.
AOS-8.13	AOS-8.13.3.0 and earlier builds	AOS-8.13.3.1 (or later)	Upgrade mobility conductors first, followed by managed mobility controllers.
AOS-8.10 (LSR)	AOS-8.10.0.23 and earlier builds	AOS-8.10.0.24 (or later)	Core campus controller upgrade; resolves SQLi on port 4343 and command injection.
Legacy / EOL Trains	AOS-8.9.x, 8.8.x, 8.7.x, 8.6.x	No patches planned (End of Support)	Migrate immediately to supported LSR trains; isolate controllers on air-gapped VLANs.

Detection engineering: neutralizing unauthenticated PAPI packets and web console exploits

For organizations unable to immediately cycle controller firmware due to campus maintenance windows, network security teams must implement strict access control rules dropping unauthorized PAPI traffic and monitoring management interfaces:

# Sigma Rule: Detect Unauthorized PAPI Traffic Originating from Non-AP Subnets
title: Anomalous Aruba PAPI Traffic from Unauthorized Internal Subnet
id: 4e81a293-1b77-49d2-8f11-9a72c104e844
status: stable
description: Detects UDP datagrams targeting port 8211 originating from general user subnets or external WAN interfaces
logsource:
  category: firewall
  product: network
detection:
  selection_destination:
    DestinationPort: 8211
    Protocol: udp
  filter_authorized_access_points:
    SourceIp|cidr:
      - '10.250.0.0/16'  # Define authorized AP management subnet
  condition: selection_destination and not filter_authorized_access_points
falsepositives:
  - Misconfigured access points provisioned in dynamic guest VLANs
level: high

At the perimeter and internal routing boundaries, firewalls must explicitly drop all inbound UDP port 8211 datagrams originating from untrusted networks, user VLANs, and external WAN connections. Web management consoles listening on TCP port 4343 must be strictly restricted to dedicated Layer 2 out-of-band management VLANs or accessible only through dedicated Privileged Access Workstations (PAWs) enforcing hardware-backed multi-factor authentication.

UK regulatory governance and critical wireless infrastructure obligations

For UK critical national infrastructure operators, healthcare trusts (NHS), higher education institutions, and enterprise networks, bulletin HPESBNW05162 highlights the systemic risk posed by unpatched wireless controllers. Under the UK Security of Network and Information Systems (NIS) Regulations 2018, operators of essential services are legally mandated to maintain technical resilience against unauthorized perimeter compromise. A vulnerability allowing root RCE across campus mobility controllers represents a severe failure of boundary controls under the National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF).

Furthermore, under UK GDPR Article 32 and the UK Data Protection Act 2018, organizations that process personal data over enterprise wireless networks bear an affirmative statutory duty to guarantee the confidentiality and integrity of transmission systems. Because mobility controllers terminate 802.1X authentication and manage WPA2/WPA3 enterprise keys, an unauthenticated root compromise allows attackers to capture plaintext user traffic and session tokens. Failure to promptly remediate known CVSS 10.0 flaws constitutes actionable security negligence under Information Commissioner's Office (ICO) regulatory enforcement guidelines.

Defender checklist: ordered engineering priorities for securing Aruba wireless networks

The exposing question

When eight separate unauthenticated vulnerabilities allow an attacker to send a single forged UDP packet or web request to take root control of your campus mobility controllers, does your network segmentation drop control plane traffic before an unauthenticated user on a guest Wi-Fi VLAN can hijack your entire wireless enterprise?

Key facts