[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHoMXnd3Y6LIcXJbcX_JZ5kJQVLrMNx0wfhOC_5UFiw8":3},{"article":4,"iocs":50,"watch_terms":75,"solutions":76,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"1aa4a55e-fe05-4e77-887d-148954db4238","HPE patches eight max severity RCE and auth bypass AOS flaws","hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws-690940","Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]","Hewlett Packard Enterprise (HPE) has released security updates to address 72 vulnerabilities in its Aruba Operating System (ArubaOS). Eight of these flaws are rated maximum severity, allowing for authentication bypass and remote code execution through low-complexity attacks. HPE urges customers to patch these issues promptly and recommends network segmentation and firewall policies for mitigation.","HPE patches 72 ArubaOS vulnerabilities, including eight critical RCE and auth bypass flaws.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F23\u002F0_Hewlett_Packard_Enterprise_HPE.jpg","2026-10-23T12:48:00+00:00","2026-10-23T13:00:12.293264+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"HPE","vendor",{"name":21,"type":22},"ArubaOS","product",{"name":24,"type":22},"Aruba Networking",{"name":26,"type":27},"enterprise wireless infrastructure","technology",{"name":29,"type":22},"HPE OneView",{"name":31,"type":22},"ArubaOS-CX","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,61,64,67,69,72],{"type":52,"value":53,"context":54},"cve","CVE-2026-79844","Authentication Bypass Leading to RCE in AOS-10",{"type":52,"value":56,"context":57},"CVE-2026-79845","Authentication Bypass in the PAPI Protocol of AOS-10",{"type":52,"value":59,"context":60},"CVE-2026-79846","Unauthenticated Command Injection in AOS-8",{"type":52,"value":62,"context":63},"CVE-2026-79847","Unauthenticated Buffer Overflow leads to RCE in AOS-10",{"type":52,"value":65,"context":66},"CVE-2026-79848","Unauthenticated SQL Injection leading to RCE in AOS-8",{"type":52,"value":68,"context":66},"CVE-2026-79849",{"type":52,"value":70,"context":71},"CVE-2026-79850","Authentication Bypass leading to RCE in AOS-8",{"type":52,"value":73,"context":74},"CVE-2026-79851","Unauthenticated Buffer Overflow leading to RCE in AOS-10",[18,21,24],{"controls":77,"vendors":165},[78,107,136],{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":108,"name":109,"problem":110,"products":111},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"slug":137,"name":138,"problem":139,"products":140},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[141,149,157],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",[],{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"hpe-arubaos-critical-flaws-expose-networks-to-rce-and-auth-bypass","HPE ArubaOS Critical Flaws Expose Networks to RCE and Auth Bypass","Eight maximum-severity vulnerabilities in HPE's ArubaOS expose enterprise network infrastructure to unauthenticated remote code execution and authentication bypass — both achievable through low-complexity attacks, meaning even less-skilled threat actors can exploit them. These flaws affect the operating system underpinning Aruba networking devices, which are widely deployed in enterprise and critical environments, dramatically amplifying the blast radius. The fact that HPE explicitly recommends network segmentation and firewall policies as interim mitigations underscores that patching alone cannot always be the first line of defense. Delayed patch application in environments running unpatched Aruba devices leaves organizations exposed to full network compromise with minimal attacker effort.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":179,"PCI DSS Requirement 6":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 requires essential and important entities to implement vulnerability handling and patch management policies; failure to patch critical network infrastructure flaws promptly risks non-compliance and significant network-level incidents.","PCI DSS Requirement 6 mandates that organisations develop and maintain secure systems by applying security patches in a timely manner, making unpatched Aruba devices in cardholder data environments a direct compliance violation.","SI-2 requires organisations to identify, report, and correct information system flaws promptly; a mature flaw remediation process with defined timelines for critical patches directly addresses the risk exposed here.","Running unpatched versions of ArubaOS is a textbook example of vulnerable and outdated components; organisations must track and update all software and firmware components, including network OS platforms.","Regular, prioritised vulnerability scanning and a defined remediation timeline would have ensured these max-severity ArubaOS flaws were identified and patched before attackers could exploit them.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in information systems, which would require an organisation to act on HPE's advisory within a defined and risk-proportionate timeframe.","The authentication bypass flaws directly undermine identity and access controls on network devices; this framework function requires that authentication mechanisms are robust and continuously validated."]