Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks

HPE Aruba Networking released security updates addressing ten ArubaOS vulnerabilities, four of which are critical unauthenticated buffer overflows (CVSS 9.8) that allow remote code execution via specially crafted packets to the PAPI UDP port 8211; affected Mobility Conductor, Controllers, WLAN and SD‑WAN Gateways across multiple ArubaOS and SD‑WAN versions (including end-of-maintenance releases). Users are advised to apply fixes immediately, with a temporary workaround for ArubaOS 8.x to enable Enhanced PAPI Security using a non-default key; seven issues were credited to researcher “Chancen.”