HPE Aruba AOS-8 AOS-10 Critical Vulnerabilities Fixed

A critical security bulletin, HPESBNW05048 rev.1, addresses a sweeping array of 27 security vulnerabilities across its AOS-8 and AOS-10 operating systems.

Released on May 12, 2026, the comprehensive patch cycle resolves highly severe flaws impacting Mobility Conductors, Mobility Controllers, and WLAN/SD-WAN Gateways managed by HPE Aruba Networking Central.

For enterprise network administrators, this bulletin requires immediate attention. The vulnerabilities range from unauthenticated Denial of Service (DoS) conditions to unauthenticated Remote Code Execution (RCE), carrying Common Vulnerability Scoring System (CVSS) base scores as high as 7.5.

With multiple vectors for system compromise, updating edge and core mobility infrastructure is paramount to maintaining network integrity.

HPE Aruba Fixes 27 Critical Vulnerabilities

The most alarming vulnerability in this disclosure is CVE-2026-23827, a heap-based buffer overflow residing in the network management service of both AOS-8 and AOS-10. This flaw allows an unauthenticated, remote attacker to achieve Remote Code Execution.

In a standard attack scenario, a threat actor could send specially crafted packets to the vulnerable management service. Because the application fails to properly manage memory allocation on the heap, the buffer overflows, allowing the attacker to overwrite adjacent memory spaces.

This can be leveraged to execute arbitrary malicious code as a highly privileged user on the underlying operating system. The result is total system compromise. Even if the RCE payload fails, the memory corruption will likely crash the service, resulting in a persistent DoS condition.

This vulnerability was discovered by security researcher n3k through the HPE Aruba Networking bug bounty program. Given that it requires zero authentication and targets core network controllers, it represents the highest risk to unpatched environments.

Threat actors who cannot achieve code execution can still cause severe operational damage through network protocol manipulation. The bulletin highlights CVE-2026-23824 and CVE-2026-23825, vulnerabilities that exist within the network protocol handling component of AOS-10 (AOS-8 controllers are unaffected by this specific flaw).

By dispatching specially crafted network messages to the affected service, an unauthenticated adversary can force critical system processes to terminate unexpectedly.

In an enterprise environment reliant on Mobility Gateways for SD-WAN routing and Wi-Fi management, a sudden process termination translates to immediate dropped connections, failed authentications, and widespread network outages.

Similarly, CVE-2026-23826 affects the AOS-8 Network Management Service, allowing unauthenticated attackers to trigger process crashes via malformed packets.

A significant portion of the vulnerabilities patched in this release were discovered by researcher zzcentury from the Ubisectech Sirius Team. While these flaws require the attacker to have authenticated access (usually administrative credentials), they are incredibly dangerous in cases of insider threats or compromised admin accounts.

Command Injection and Arbitrary File Manipulation Vulnerabilities CVE-2026-44853 and CVE-2026-44854 expose the web-based management interface to command injection.

An authenticated attacker can upload arbitrary files or alter the file path parameters during certificate downloads (as seen in CVE-2026-44852). By escaping the intended web-directory constraints, attackers can overwrite critical system binaries, effectively escalating privileges to execute arbitrary commands at the OS level.

PAPI Protocol Flaws and Buffer Overflows HPE Aruba utilizes the Process Application Programming Interface (PAPI) protocol for internal communication between APs, controllers, and management interfaces.

The security bulletin reveals a cluster of authenticated stack-based buffer overflows (CVE-2026-44855 through CVE-2026-44859) within the underlying management services accessed via the CLI and PAPI.

By sending malformed requests to these services, an authenticated admin can trigger a stack overflow, overriding the instruction pointer to execute shellcode.

Furthermore, command injection flaws within the PAPI CLI service (CVE-2026-44870, CVE-2026-44871) allow rogue administrators to break out of the restricted ArubaOS shell and interact directly with the underlying Linux kernel.

SQL Injection in Backend Queries The Ubisectech Sirius Team also identified multiple SQL injection vulnerabilities (CVE-2026-44860 through CVE-2026-44864) accessible through the management protocol.

Unsanitized input passed to backend database queries allows attackers to read, modify, or destroy underlying database structures, which can be weaponized into full command execution.

Patch and Mitigation

An interesting logical flaw patched in this cycle is CVE-2026-44873, which affects AOS-8. The vulnerability involves insufficient session invalidation when a user account is deactivated.

If an administrator disables a compromised account, any active sessions tied to that user remain fully functional until they naturally expire.

This creates a dangerous window where an attacker, having already authenticated, can continue to navigate the network and exfiltrate data despite their account being administratively revoked. HPE advises utilizing the aaa user delete command to forcibly kill active sessions as an interim workaround.

These vulnerabilities broadly impact the following AOS branches:

AOS-10.8.x.x: 10.8.0.0 and below
AOS-10.7.x.x: 10.7.2.2 and below
AOS-10.4.x.x: 10.4.1.10 and below
AOS-8.13.x.x: 8.13.1.1 and below
AOS-8.12.x.x: 8.12.0.6 and below
AOS-8.10.x.x: 8.10.0.21 and below

Notably, several End of Maintenance (EoM) versions (including AOS-8.6 through AOS-8.11, and AOS-10.3 through 10.6) are affected but will not receive patches. However, HPE made a rare exception for the EoM AOS-8.12 branch, providing a one-time patch.

Immediate Workarounds and Defense-in-Depth If immediate patching is not feasible, HPE strongly recommends heavily restricting access to the CLI and web-based management interfaces.

Layer 2 Isolation: Management interfaces must be placed on a dedicated, strictly controlled Layer 2 segment or VLAN.
Layer 3 Firewalls: Implement strict firewall policies to ensure that management ports (specifically UDP port 8444 for PAPI) are only accessible to trusted infrastructure devices, such as peer controllers and managed Access Points.
Auditing: Enhance accounting controls to log all user activities and resource usage to detect anomalous behavior.

The release of HPESBNW05048 rev.1 is a stark reminder of the complexities involved in securing embedded network operating systems. The sheer volume of vulnerabilities from heap overflows to SQL injections highlights the critical role that independent researchers and bug bounty programs play in fortifying enterprise hardware.

Network administrators must prioritize upgrading their HPE Aruba infrastructure immediately to ensure their wireless and SD-WAN deployments remain hardened against exploitation.