HPE Patches Eight Critical ArubaOS RCE and Authentication‑Bypass Flaws (CVE‑2026‑79844‑79851)

What happened

Hewlett Packard Enterprise issued security updates for ArubaOS that remediate 72 vulnerabilities, eight of which are maximum‑severity authentication bypass or remote code execution flaws (CVE‑2026‑79844‑79851). The flaws affect AOS‑8 and AOS‑10 and can be exploited remotely without credentials or user interaction.

Why it matters for trust and compliance

• These patches test an organization’s ability to maintain a documented, continuously monitored vulnerability‑management program and to provide auditable proof that remediation and network‑segmentation controls are in place.
• Demonstrates that you can collect and retain evidence of timely patch deployment for audit purposes.
• Shows that network‑segmentation and logging controls are enforced, satisfying multiple framework objectives with a single control mapping.

Who is affected

Recommended actions

1. Apply the HPE security updates to all affected ArubaOS devices without delay.
2. Restrict management interfaces to a dedicated VLAN or firewall‑protected segment and enable comprehensive activity logging.
3. Document patch dates, asset identifiers, and verification screenshots in a continuous‑control evidence store.
4. Map the remediation steps to your framework of record using a control‑mapping tool.