HPE patches 72 ArubaOS flaws, including eight max-severity RCE and auth bypass bugs

HPE released security updates fixing 72 vulnerabilities in ArubaOS (AOS), eight of them maximum severity, covering authentication bypass and remote code execution. The flaws affect multiple AOS-8 and AOS-10 versions and can be exploited remotely without privileges or user interaction. HPE says it has no evidence of public exploit code or in-the-wild attacks.

• 72 vulnerabilities patched in ArubaOS, eight rated maximum severity
• AOS-8 and AOS-10 affected; flaws are remotely exploitable without privileges
• HPE advises restricting CLI and web management to a dedicated VLAN and firewall policies
• No public exploit code or in-the-wild exploitation observed