HPE's Own Records Put Seven Wireless Software Flaws at the Top of the Severity Scale
Hewlett Packard Enterprise has scored seven flaws in ArubaOS at 10.0, the top of the CVSS severity scale the security industry uses, in vulnerability records the company published Oct. 22, 2026, under its security bulletin HPESBNW05162. HPE is the authority that assigns identifiers for its own products, so the scores are its own.
ArubaOS is the software that runs HPE's Aruba Networking wireless controllers, gateways and access points, the equipment carrying Wi-Fi traffic inside offices, campuses, hospitals and warehouses. The records say every one of the seven can be reached over the network and needs no password, no account privileges and no action from anyone using the system.
HPE's own descriptions put the seven into four groups. Some let a remote attacker get past the login controls on the affected interface and run commands on the host underneath; in one case HPE says those commands run at the highest privilege level on the device's operating system, which it describes as complete system compromise. Others allow commands to be slipped in directly, or database queries to be manipulated, ending the same way, with commands running on the underlying operating system. The rest are memory-handling faults that HPE says end with code running as a privileged user.
The records list the affected releases. On AOS-10 they are 10.4.0.0 through 10.4.1.13, 10.7.0.0 through 10.7.2.6 and 10.8.0.0 through 10.8.1.1. On AOS-8 they are 8.10.0.0 through 8.10.0.23 and 8.13.0.0 through 8.13.3.0. None of the seven records names a fixed build; each gives one reference and no other, HPE's bulletin HPESBNW05162.
CISA attached its own assessment to each of the seven records on Oct. 22, 2026: no exploitation observed at that point, an attack judged automatable and the technical impact rated total. HPE credits the finds to its internal security research, and two of them also to a researcher who reported through its bug bounty program.
