HPE: dozens of critical flaws in networking products

Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

HPE patched dozens of critical flaws in its networking products, including eight max-severity security defects that could lead to remote code execution and authentication bypass.

Do this now

Check HPE's advisory for fixes to the eight critical networking flaws and restrict access to affected products meanwhile.

Still cooking for ArubaOS (AOS) and Simple Inventory System.

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 13:17 UTC
Identifiers: CVE-2026-79844
CVE-2026-79845
CVE-2026-79846
CVE-2026-79847
CVE-2026-79848
CVE-2026-79849
CVE-2026-79850
CVE-2026-79851
CVSS: 10.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## HPE: dozens of critical flaws in networking products
Severity: critical. Patch status: fix status unknown.
Affected: Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
Ids: CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, CVE-2026-79851

HPE patched dozens of critical flaws in its networking products, including eight max-severity security defects that could lead to remote code execution and authentication bypass.

## Steps
1. Search the repo, its CI and infra config for Hewlett Packard Enterprise (HPE) ArubaOS (AOS). If present, report the version in use and whether it's affected.
2. ArubaOS (AOS) 10.8.x, 10.7.x, 10.4.x, 8.13.x, 8.10.x; Simple Inventory System 1.0.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| ArubaOS (AOS) 8.10 to 10.8 (5 lines) | not named in the CVE record | check the vendor advisory | restrict network access to it |
| Simple Inventory System 1.0.x | not named in the CVE record | check the vendor advisory | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-79844") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.securityweek.com/hpe-patches-dozens-of-critical-flaws-in-networking-products/
https://pwned.coffee/i/hpe-dozens-of-critical-flaws-in-networking-products

Timeline

27 Oct 2026, 13:17 UTC
Fix status: patched → unknown.
27 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-79845 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
ArubaOS (AOS) 8.10.0.0 to 10.8.0.0 (5 lines) fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 27 Oct
Simple Inventory System = 1.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 27 Oct
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA hpe) for CVE-2026-79844
Last checked: 27 Oct 2026, 15:18 UTC

Product	Affected	Fixed in	Source
ArubaOS (AOS)	8.10.0.0 to 10.8.0.0 (5 lines)	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 27 Oct
Simple Inventory System	= 1.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

securityweek.com: HPE Patches Dozens of Critical Flaws in Networking Products

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee