1. Executive summary
HPE Aruba published two security bulletins on 22 October 2026 covering multiple vulnerabilities in ArubaOS (AOS) and ClearPass Policy Manager (CPPM), and CERT-FR issued advisory CERTFR-2026-AVI-1369 the following day. The flaws allow remote code execution, privilege escalation, remote denial of service, SQL injection, SSRF and XSS. The most severe entries carry CVSS 10.0 (CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-202# 79850, CVE-2026-79851) and CVSS 9.2 (CVE-2026-109618, CVE-2026-109619); none is in CISA KEV and EPSS scores are low (12% and 6% for the two 9.2 flaws, 0-1% for the rest). For EMEA financial services the exposure is concentrated in network access control: ClearPass is the policy decision point for wired, wireless and guest access, and AOS controllers and gateways sit on the same path, so an unauthenticated RCE on either can hand an attacker the identity and segmentation layer that protects internal systems.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | ClearPass and AOS are ICT systems whose compromise would require detection, containment and recovery under the incident management process; the vendor fix is a firmware upgrade that must be planned and executed | The patch rollout needs a change record, a rollback path and a tested recovery procedure for the NAC and wireless estate, not an ad hoc upgrade window |
| DORA Art. 18 | The flaws permit unauthenticated remote code execution and privilege escalation on the policy decision point, which is a plausible route to a major incident | Classification must weigh loss of network access control and possible lateral movement, not just the device outage |
| NIS2 Art. 21(2)(d) | ClearPass and AOS are supplied by a third party and the fix depends on the vendor's bulletins and firmware; the client's supply chain security measures cover how those updates are received, verified and applied | The client must be able to evidence that vendor security advisories for network infrastructure are tracked and remediated within a defined window |
3. Technical analysis & attack chain
This is a vendor patch cycle covering at least ten CVEs with published severity scores, alongside a much larger set of CVE references in the CERT-FR advisory that carry no score in the data available here. The triage table below is ordered by the CVSS and EPSS values on record. No exploitation in the wild is recorded for any of these CVEs: none is in CISA KEV, and EPSS is at or below 12% across the scored set.
| CVE | Component | CVSS | KEV / EPSS | Why it matters |
|---|---|---|---|---|
| CVE-2026-79844 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 0% | Authentication bypass via alternate path or channel (CWE-288); bypasses the access control that fronts the management plane |
| CVE-2026-79846 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 0% | No CWE recorded in the data; maximum severity, treat as remotely exploitable until the vendor bulletin says otherwise |
| CVE-2026-79847 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 0% | Memory buffer bounds error (CWE-119); classic pre-auth memory corruption route to code execution |
| CVE-2026-79848 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 1% | SQL injection (CWE-89); database read/write and possible authentication bypass |
| CVE-2026-79849 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 1% | SQL injection (CWE-89); same class as above |
| CVE-2026-79850 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 0% | Authentication bypass via alternate path or channel (CWE-288) |
| CVE-2026-79851 | AOS / ClearPass (per CERT-FR scope) | 10.0 CRITICAL | Not in KEV / 0% | Memory buffer bounds error (CWE-119) |
| CVE-2026-109618 | AOS (per CERT-FR scope) | 9.2 CRITICAL | Not in KEV / 12% | Use after free (CWE-416) with CWE-755; highest EPSS in the set, so the most likely to attract scanning |
| CVE-2026-109619 | AOS (per CERT-FR scope) | 9.2 CRITICAL | Not in KEV / 6% | Use after free (CWE-416) with CWE-755 |
| CVE-2026-79845 | AOS / ClearPass (per CERT-FR scope) | 5.5 MEDIUM | Not in KEV / 0% | SQL injection (CWE-89) with CWE-74; lower score but same injection class as the 10.0 entries |
The CERT-FR advisory lists a much longer set of CVE references (CVE-2026-79852 through CVE-2026-79956, CVE-2026-95704 through CVE-2026-95721) for which no CVSS, CWE or EPSS value is available in the data supplied here. They are in scope for the same firmware updates and should be treated as covered by the patch action in §4 rather than assessed individually.
Affected versions, from CERT-FR:
- ArubaOS 10.4.x.x prior to 10.4.1.14
- ArubaOS 10.7.x.x prior to 10.7.2.7
- ArubaOS 10.8.x.x prior to 10.8.1.2
- ArubaOS 8.10.x.x prior to 8.10.0.24
- ArubaOS 8.13.x.x prior to 8.13.3.1
- ClearPass Policy Manager 6.11.x prior to 6.11.16
- ClearPass Policy Manager 6.14.x prior to 6.14.1
The two vendor bulletins are hpe_networking_-hpesbnw05162 and hpe_networking-_hpesbnw05171, both dated 22 October 2026. CERT-FR does not state which bulletin covers which product, and the CVE-to-product mapping above is inferred from the affected-version lists and the vulnerability classes named in the advisory. Confirm the per-CVE product and fixed-version mapping against the two HPE bulletins before scheduling.
Attack chain, at the level the sources support:
- An attacker reaches an exposed ArubaOS or ClearPass management or authentication interface. CERT-FR does not state which ports or services are exposed, and the vendor bulletins were not available in the material used here.
- The attacker exploits one of the authentication bypass flaws (CVE-2026-79844, CVE-2026-79850) to reach functionality that should require credentials, or a memory corruption flaw (CVE-2026-79847, CVE-2026-79851, CVE-2026-109618, CVE-2026-109619) to execute code.
- SQL injection flaws (CVE-2026-79845, CVE-2026-79848, CVE-2026-79849) give access to the backing database, which on ClearPass holds policy, device and identity data.
- CERT-FR lists privilege escalation and remote code execution as outcomes, so an attacker who lands on the appliance can move from a low-privilege foothold to control of the policy engine.
CERT-FR does not describe the exploitation mechanics for any individual CVE, and no proof-of-concept, exploit code, post-exploitation behaviour, persistence mechanism, command-and-control channel or observed campaign is documented in the sources. The risk categories listed (data confidentiality and integrity impact, security policy bypass, remote DoS, RCE, SSRF, XSS, SQLi, privilege escalation) are the vendor and CERT-FR classification of impact, not observed attacker activity. No attribution is made and none should be inferred.
4. Mitigation & containment
P1, within 24 hours
- Inventory every ArubaOS controller, gateway and ClearPass node and record its running version against the affected list above. Any device on 10.4.x.x below 10.4.1.14, 10.7.x.x below 10.7.2.7, 10.8.x.x below 10.8.1.2, 8.10.x.x below 8.10.0.24, 8.13.x.x below 8.13.3.1, CPPM 6.11.x below 6.11.16 or CPPM 6.14.x below 6.14.1 is in scope.
- Restrict management-plane access to ClearPass and ArubaOS to named administrative networks. The authentication bypass flaws (CVE-2026-79844, CVE-2026-79850) mean any exposed management interface should be treated as reachable without credentials until patched.
- Pull both HPE bulletins (hpesbnw05162 and hpesbnw05171) and confirm the per-CVE fixed version for each product in your estate. CERT-FR gives the version floors but not the CVE-to-bulletin mapping.
P2, within 72 hours
- Upgrade ClearPass to 6.11.16 or 6.14.1 (or later) and ArubaOS to the fixed build for your branch. Schedule ClearPass first: it is the policy decision point and the SQL injection and authentication bypass flaws sit on the identity path.
- Where an immediate upgrade is not possible, place the affected appliance behind a restricting firewall rule and remove it from any internet-facing exposure. CERT-FR does not identify which services are vulnerable, so restrict the whole management and authentication surface rather than guessing at ports.
- Review ClearPass and ArubaOS logs for authentication events that succeeded without a matching credential exchange, and for SQL error responses on the authentication and management interfaces. The sources give no log format or event IDs, so this is a manual review against your own baseline.
P3, within 7 days
- Add the fixed versions to the standard build and to the configuration baseline so new deployments do not reintroduce the affected releases.
- Confirm that the vendor advisory subscription for HPE Aruba Networking reaches the team that owns the NAC and wireless estate. This is the fourth CERT-FR advisory for HPE Aruba Networking products in the supplied material since July 2026 (CERTFR-2026-AVI-0846, -0908, -1151, -1217 and this one), which indicates a steady patch cadence that the change process needs to absorb.
5. Indicators of compromise
No indicators of compromise available in the source material. CERT-FR and the related advisories describe vulnerability classes and affected versions only; they publish no hashes, network indicators, file paths or behavioural telemetry.
6. Detection
Insufficient indicators to author detection rules. The sources contain no malicious strings, command lines, file names, registry keys or network artefacts to build a YARA or Sigma rule from. Detection for this item rests on version inventory (the affected-version list in §3) and on restricting management-plane access, not on signature matching.
CVE assessment
10 referenced CVEs — 9 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-79844 | 10.0 Critical | — | 0% | No description provided |
| CVE-2026-79846 | 10.0 Critical | — | 0% | No description provided |
| CVE-2026-79847 | 10.0 Critical | — | 0% | No description provided |
| CVE-2026-79848 | 10.0 Critical | — | 1% | No description provided |
| CVE-2026-79849 | 10.0 Critical | — | 1% | No description provided |
| CVE-2026-79850 | 10.0 Critical | — | 0% | No description provided |
| CVE-2026-79851 | 10.0 Critical | — | 0% | No description provided |
| CVE-2026-109618 | 9.2 Critical | — | 12% | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts… |
| CVE-2026-109619 | 9.2 Critical | — | 6% | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly… |
| CVE-2026-79845 | 5.5 Medium | — | 0% | A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the fil… |
7. Sources
- ANSSI France CERT, Multiples vulnérabilités dans les produits HPE Aruba Networking (CERTFR-2026-AVI-1369), 2026-10-23. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1369/
- HPE Aruba Networking security bulletin hpe_networking_-hpesbnw05162, 2026-10-22. https://csaf.arubanetworking.hpe.com/2026/hpe_networking-_hpesbnw05162.txt
- HPE Aruba Networking security bulletin hpe_networking_-hpesbnw05171, 2026-10-22. https://csaf.arubanetworking.hpe.com/2026/hpe_networking-_hpesbnw05171.txt
- ANSSI France CERT, Multiples vulnérabilités dans HPE Aruba Networking ClearPass Policy Manager (CERTFR-2026-AVI-1151), 2026-09-10. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1151/
- ANSSI France CERT, Multiples vulnérabilités dans les produits HPE Aruba Networking (CERTFR-2026-AVI-1277), 2026-10-07. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1277/
- ANSSI France CERT, Multiples vulnérabilités dans les produits HPE Aruba Networking (CERTFR-2026-AVI-1217), 2026-09-23. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1217/
- ANSSI France CERT, Multiples vulnérabilités dans les produits HPE Aruba Networking (CERTFR-2026-AVI-0908), 2026-07-22. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0908/
- ANSSI France CERT, Multiples vulnérabilités dans les produits HPE Aruba Networking (CERTFR-2026-AVI-0846), 2026-07-08. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0846/
- BSI Germany, Aruba ClearPass Policy Manager: Mehrere Schwachstellen (WID-SEC-2026-3762). https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3762
8. Adverse Trace position
Adverse Trace assesses this as a high-priority patch action rather than an active incident. The CVSS scores are severe (seven CVEs at 10.0, two at 9.2) but the exploitation signal is weak: none of the scored CVEs is in CISA KEV and EPSS tops out at 12% (CVE-2026-109618), so there is no evidence of exploitation in the wild in the data available. The severity assessment rests on the CVSS and CWE values on record, not on the CERT-FR prose. The client impact is concentrated in the NAC and wireless estate: ClearPass is the policy decision point and ArubaOS carries the access traffic, so a compromise of either undermines segmentation for everything behind it. The per-CVE product mapping and the fixed-version detail beyond the CERT-FR version floors rest on the vendor bulletins, which were not available in the material used here; confirm them before scheduling. We will monitor the HPE bulletins and CISA KEV for any change in exploitation status, and will reissue if a scored CVE is added to KEV or if EPSS rises materially above the current 12% ceiling.
Published via PulseTrace — Adverse Trace threat intelligence.