HPE Aruba 10.0 Flaws: What DFARS 7012 Asks Before Any Incident

Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 sets duties that start before an incident, not after one. HPE's ArubaOS bulletin tests the before part.

On October 22, 2026, HPE Networking published advisory HPESBNW05162. It fixes 72 flaws in ArubaOS 8 and 10. HPE rates eight at CVSS 3.1 10.0. Seven resolve to HPE records. One ID needs a note. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10.

The eight listed flaws

Common Vulnerabilities and Exposures (CVE) is the public record system.

• CVE-2026-79844: AOS-10 authentication bypass to command execution.
• CVE-2026-79845: AOS-10 PAPI protocol authentication bypass to admin access. HPE lists it at 10.0. Its public CVE record names another product, so this article links it to the HPE advisory instead.
• CVE-2026-79847 and CVE-2026-79851: AOS-10 buffer overflows to remote code execution.
• CVE-2026-79846: AOS-8 command injection.
• CVE-2026-79848 and CVE-2026-79849: AOS-8 SQL injections to command execution.
• CVE-2026-79850: AOS-8 authentication bypass to root commands.

Each needs network access only. No login is needed. No user must act.

One ID needs care

HPE lists CVE-2026-79845 at 10.0 for the PAPI flaw. The public CVE record for that ID names a different product. It scores 7.3, not 10.0. Count seven verified 10.0 IDs until the record is fixed.

The three duties this bulletin touches

First, safeguarding. Controllers hold Wi-Fi keys and network config. Patch them to the fixed builds: AOS-10 10.8.1.2, 10.7.2.7, and 10.4.1.14, and AOS-8 8.13.3.1 and 8.10.0.24.

Second, reporting readiness. If a controller is compromised, the 72 hour incident report clock starts. A team that cannot name its controllers cannot scope the incident in time.

Third, preservation. The clause requires preserving system images and monitoring data for 90 days after an incident. Controller logs must already flow somewhere safe. Turning logging on after the fact recovers nothing.

HPE reported on October 22, 2026 that it knew of no public exploit code. It also knew of no exploitation in the wild. No eight ID is in the CISA Known Exploited Vulnerabilities catalog as checked on October 25, 2026. Use the quiet period to patch and to prove logging works.

Sources

• HPE Networking security advisory HPESBNW05162, Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 and AOS-8), October 22, 2026.
• CVE-2026-79844 record, CVE Program.
• The PAPI flaw listed as CVE-2026-79845 is sourced to the HPE advisory above. Its public CVE record currently names another product.
• CVE-2026-79846 record, CVE Program.
• CVE-2026-79847 record, CVE Program.
• CVE-2026-79848 record, CVE Program.
• CVE-2026-79849 record, CVE Program.
• CVE-2026-79850 record, CVE Program.
• CVE-2026-79851 record, CVE Program.
• Original diagram by PolicyCortex.

Next step

Want safeguarding and reporting evidence in one place? See how PolicyCortex collects it from live systems.