HPE ArubaOS (AOS-10): Authentication bypass leading to remote code execution
Summary
An authentication bypass in an affected interface of HPE ArubaOS 10 (AOS-10) allows an unauthenticated attacker on an adjacent network segment to get past authentication controls. Successful exploitation allows arbitrary commands to run as a privileged user on the underlying operating system, which means full compromise of the wireless controller, gateway or access point. No credentials are needed, but the attacker must be on an adjacent network.
Affected
- ArubaOS 10.8.0.0 to 10.8.1.1
- ArubaOS 10.7.0.0 to 10.7.2.6
- ArubaOS 10.4.0.0 to 10.4.1.13
- Version ranges from secondary sources; verify against the HPE advisory before acting
Fixed in
- AOS-10 10.8.1.2
- AOS-10 10.7.2.7
- AOS-10 10.4.1.14
- Branches 10.6, 10.3 and 8.12 are end-of-maintenance and not covered by the bulletin; move to a supported branch
Workaround
- No vendor-stated workaround specific to this CVE; applying the fixed version is the remedy.
- General measure (not vendor guidance): restrict management access to controllers, gateways and APs to a dedicated management VLAN and limit who can reach the management ports.
Exploitation
- HPE knows of no public exploit code or attacks.
- No public proof-of-concept found in research.
- No CISA KEV listing found in research; verify directly in the catalog.
Our recommendation
- Upgrade AOS-10 controllers, gateways and APs to 10.8.1.2, 10.7.2.7 or 10.4.1.14 (or later) in the next maintenance window, prioritising shared or guest-accessible networks.
- Move end-of-maintenance branches (10.6, 10.3, 8.12) to a supported branch.
- Restrict management access to a dedicated VLAN and confirm that no management interface is reachable from the internet.
- Monitor controllers for unexpected commands or configuration changes until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 rev.1 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS patches ccb.belgium.be
- CyberExperts: Aruba AOS wireless patches (October 2026) cyberexperts.com
- Windowsforum: HPE Aruba AOS 8 and AOS 10 security update windowsforum.com
- CyberPress: Critical HPE Aruba AOS vulnerability cyberpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:12.
Original description (NVD)
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.