HPE Aruba 10.0 Flaws and the FedRAMP Remediation Clock

Federal Risk and Authorization Management Program (FedRAMP) remediation clocks do not wait for exploitation. They start at discovery. HPE's ArubaOS bulletin starts eight of them at once.

On October 22, 2026, HPE Networking published advisory HPESBNW05162. It fixes 72 flaws in ArubaOS 8 and 10. HPE rates eight at CVSS 3.1 10.0. Seven resolve to HPE records. One ID needs a note. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10.

The eight listed flaws

Common Vulnerabilities and Exposures (CVE) is the public record system.

• CVE-2026-79844: AOS-10 authentication bypass to command execution.
• CVE-2026-79845: AOS-10 PAPI protocol authentication bypass to admin access. HPE lists it at 10.0. Its public CVE record names another product, so this article links it to the HPE advisory instead.
• CVE-2026-79847 and CVE-2026-79851: AOS-10 buffer overflows to remote code execution.
• CVE-2026-79846: AOS-8 command injection.
• CVE-2026-79848 and CVE-2026-79849: AOS-8 SQL injections to command execution.
• CVE-2026-79850: AOS-8 authentication bypass to root commands.

Each needs network access only. No login is needed. No user must act.

One ID needs care

HPE lists CVE-2026-79845 at 10.0 for the PAPI flaw. The public CVE record for that ID names a different product. It scores 7.3, not 10.0. Count seven verified 10.0 IDs until the record is fixed.

How the clocks run

FedRAMP gives high flaws 30 days to remediate. Moderate flaws get 90 days. Low flaws get 180 days. A 10.0 flaw is high by any measure. The Plan of Action and Milestones (POA&M) entry for each flaw should already exist.

The fixed builds are AOS-10 10.8.1.2, 10.7.2.7, and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24. Record the discovery date as October 22, 2026. Record the planned fix date inside the 30 day window. Close each entry only with a re-scan, not with a ticket status.

Continuous monitoring also asks about scope. Wireless controllers often sit outside the cloud boundary on paper. They still serve the people who use the system. If a controller is in the path, it belongs in the inventory.

HPE reported on October 22, 2026 that it knew of no public exploit code. It also knew of no exploitation in the wild. No eight ID is in the CISA Known Exploited Vulnerabilities catalog as checked on October 25, 2026. A KEV listing later would shorten every conversation about priority.

Sources

• HPE Networking security advisory HPESBNW05162, Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 and AOS-8), October 22, 2026.
• CVE-2026-79844 record, CVE Program.
• The PAPI flaw listed as CVE-2026-79845 is sourced to the HPE advisory above. Its public CVE record currently names another product.
• CVE-2026-79846 record, CVE Program.
• CVE-2026-79847 record, CVE Program.
• CVE-2026-79848 record, CVE Program.
• CVE-2026-79849 record, CVE Program.
• CVE-2026-79850 record, CVE Program.
• CVE-2026-79851 record, CVE Program.
• Original diagram by PolicyCortex.

Next step

Want remediation clocks tracked against live evidence? See how PolicyCortex collects it from live systems.