HPE Issues Broad Patch for Critical ArubaOS Flaws, Fixes 72 Vulnerabilities

Hewlett Packard Enterprise (HPE) has rolled out a comprehensive security update for its Aruba Operating System (ArubaOS), addressing a total of 72 reported vulnerabilities, eight of which are classified as maximum severity due to their potential for authentication bypass and remote code execution.

The update, announced in a security advisory earlier this week, targets the most serious flaws that could allow attackers to gain unauthorized access to network infrastructure or execute malicious code remotely. HPE’s advisory notes that the eight high‑severity issues could be exploited without prior authentication, posing a significant risk for enterprises that rely on ArubaOS for wireless and wired networking.

ArubaOS is a core component of HPE’s networking portfolio, powering a range of access points, switches, and controllers used in corporate, educational, and public‑sector environments. Because the operating system runs on devices that manage network traffic, any compromise could lead to broader network infiltration, data exfiltration, or service disruption.

Security researchers who first uncovered the vulnerabilities highlighted the ease with which an attacker could chain the authentication bypass with code execution paths to take full control of affected devices. While HPE did not disclose specific technical details of each flaw, the company confirmed that the patches have been thoroughly tested and are now available through its standard update mechanisms.

Enterprise IT teams are urged to apply the updates promptly, especially those managing critical or publicly accessible network segments. HPE recommends verifying firmware versions, reviewing the advisory for affected product models, and scheduling the patches during maintenance windows to minimize operational impact.

The broader patch underscores the ongoing challenge of securing increasingly complex network ecosystems. As organizations expand their reliance on cloud‑connected devices and remote work setups, the attack surface for network infrastructure grows, making timely remediation essential. Analysts expect that HPE will continue to monitor the situation and may release additional guidance or hotfixes should new information emerge.