HPE 一口氣修補 ArubaOS 72 項漏洞，其中 8 項屬最高危險級別
Hewlett Packard Enterprise（HPE）已發布安全更新，修補 Aruba Operating System（ArubaOS）的 72 個漏洞，當中包括 8 個評為最高危險級別（maximum severity）的驗證繞過及遠端程式碼執行（RCE）問題。據 BleepingComputer 報道，這批漏洞影響 Aruba 的控制器與閘道器裝置。
這類設備通常部署在網絡邊緣、面向外部，漏洞一旦可利用，暴露面就是現成入口。使用 Aruba 控制器與閘道器的團隊應儘快核對 HPE 官方公告的受影響版本表，並把升級排進近期維護窗口。
這批漏洞危在哪
- 數量與等級：72 項漏洞集中發布，其中 8 項達最高危險級別，涵蓋驗證繞過與 RCE——兩者都可直接推進至未授權存取或任意代碼執行。
- 攻擊情境：驗證繞過指讓攻擊者在沒有有效憑證的情況下通過認證；RCE 則是在設備上執行任意程式碼。8 個高危漏洞各自的攻擊向量——是否需要預先認證、能否從外部直接觸發——需逐一核對 HPE 公告本身的欄位。
- 資產位置：控制器與閘道器廣泛用於校園及分支網絡，管理整站的接入與流量，部分部署還對外開放管理介面；這類面向外部的資產一旦暴露，等同把開關交到攻擊者手上。
建議的處理順序
- 盤點資產：識別所有 Aruba 控制器與閘道器，記錄現行 ArubaOS 版本。
- 取得權威資料：CVE 編號、CVSS 評分及受影響／已修復版本對照，一律以 HPE 官方安全公告為準；BleepingComputer 的摘要未逐一列出這些欄位。
- 選擇正確的修復版本：升級至對應受影響分支的已修復版本，而非盲目追最新版——跨大版本升級在維護窗口有限的網絡設備上風險更高。
- 檢視可及性：評估管理介面的外露程度，收緊不必要的外部存取。
- 留意後續狀態：追蹤 CISA KEV 目錄對相關編號的收錄情況，作為利用風險的參考指標。來源報導撰寫時未提及野外利用；未提及不等於廠方確認不存在。
補丁為什麼總是延後
控制器是核心元件，牽動整個站點，維護窗口罕見，升級又可能中斷現行連線，於是「下個季度再說」成為常態。但當漏洞涉及驗證繞過或可未經認證觸發的 RCE、而目標又面向互聯網時，延遲本身即會擴大風險暴露。72 項漏洞集中發布，正是重新檢視網絡作業系統補丁流程的時機。
來源：BleepingComputer（本欄目按 intake 資料於 2026 年 10 月 23 日編發；CVE、CVSS 與版本對照請以 HPE 官方安全公告為準）。
English version
HPE patches 72 ArubaOS flaws at once, eight of them rated maximum severity
Hewlett Packard Enterprise has released security updates covering 72 vulnerabilities in the Aruba Operating System, including eight rated at maximum severity — a set of authentication bypass and remote code execution (RCE) issues. According to BleepingComputer, the flaws affect Aruba controllers and gateways.
These devices typically sit at the network edge facing outward, so once a flaw is exploitable the exposed surface becomes a ready-made way in. Teams running Aruba controllers and gateways should check their current firmware against the affected-version table in HPE's own advisory and schedule the upgrade into an upcoming maintenance window.
Why this batch matters
- Volume and severity: 72 flaws disclosed in a single release, eight of them at maximum severity, spanning authentication bypass and RCE — both of which can lead directly to unauthorised access or arbitrary code execution.
- Attack scenarios: an authentication bypass lets an attacker pass authentication without valid credentials, while RCE means running arbitrary code on the device. Whether each of the eight critical bugs requires prior authentication or can be triggered from outside must be read from the fields of HPE's advisory itself.
- Asset position: controllers and gateways commonly serve campus and branch networks, handling site-wide access and traffic, and some deployments expose management interfaces to the internet.
Suggested sequence
- Inventory: list every Aruba controller and gateway and record its current ArubaOS version.
- Get authoritative data: CVE identifiers, CVSS scores, and the affected/fixed version mapping should be taken from HPE's advisory; the BleepingComputer summary does not itemise them.
- Target the right fix: move to the fixed release for the affected branch rather than simply chasing the newest version — cross-major upgrades on network gear with tight maintenance windows carry extra risk.
- Review exposure: check how open the management interfaces are and remove unnecessary external access.
- Track follow-up status: watch CISA's KEV catalogue for these identifiers as a signal of exploitation risk. The source report did not describe any in-the-wild exploitation; not mentioning it is not the same as confirming it does not exist.
Why patches keep slipping
Controllers are core components that affect an entire site, maintenance windows are rare, and upgrades can drop existing connections — so "next quarter" becomes the default. But when a flaw involves authentication bypass or unauthenticated RCE, and the target faces the internet, delay itself widens the exposure. A single release of 72 flaws is a good moment to revisit how network OS patching is scheduled.
Source: BleepingComputer (compiled on 23 October 2026 per intake notes; CVE, CVSS, and version mappings refer to HPE's official advisory).
HPE 一口氣修補 ArubaOS 72 項漏洞，其中 8 項屬最高危險級別
Hewlett Packard Enterprise（HPE）已發布安全更新，修補 Aruba Operating System（ArubaOS）的 72 個漏洞，當中包括 8 個評為最高危險級別（maximum severity）的驗證繞過及遠端程式碼執行（RCE）問題。據 BleepingComputer 報道，這批漏洞影響 Aruba 的控制器與閘道器裝置。
這類設備通常部署在網絡邊緣、面向外部，漏洞一旦可利用，暴露面就是現成入口。使用 Aruba 控制器與閘道器的團隊應儘快核對 HPE 官方公告的受影響版本表，並把升級排進近期維護窗口。
這批漏洞危在哪
- 數量與等級：72 項漏洞集中發布，其中 8 項達最高危險級別，涵蓋驗證繞過與 RCE——兩者都可直接推進至未授權存取或任意代碼執行。
- 攻擊情境：驗證繞過指讓攻擊者在沒有有效憑證的情況下通過認證；RCE 則是在設備上執行任意程式碼。8 個高危漏洞各自的攻擊向量——是否需要預先認證、能否從外部直接觸發——需逐一核對 HPE 公告本身的欄位。
- 資產位置：控制器與閘道器廣泛用於校園及分支網絡，管理整站的接入與流量，部分部署還對外開放管理介面；這類面向外部的資產一旦暴露，等同把開關交到攻擊者手上。
建議的處理順序
- 盤點資產：識別所有 Aruba 控制器與閘道器，記錄現行 ArubaOS 版本。
- 取得權威資料：CVE 編號、CVSS 評分及受影響／已修復版本對照，一律以 HPE 官方安全公告為準；BleepingComputer 的摘要未逐一列出這些欄位。
- 選擇正確的修復版本：升級至對應受影響分支的已修復版本，而非盲目追最新版——跨大版本升級在維護窗口有限的網絡設備上風險更高。
- 檢視可及性：評估管理介面的外露程度，收緊不必要的外部存取。
- 留意後續狀態：追蹤 CISA KEV 目錄對相關編號的收錄情況，作為利用風險的參考指標。來源報導撰寫時未提及野外利用；未提及不等於廠方確認不存在。
補丁為什麼總是延後
控制器是核心元件，牽動整個站點，維護窗口罕見，升級又可能中斷現行連線，於是「下個季度再說」成為常態。但當漏洞涉及驗證繞過或可未經認證觸發的 RCE、而目標又面向互聯網時，延遲本身即會擴大風險暴露。72 項漏洞集中發布，正是重新檢視網絡作業系統補丁流程的時機。
來源：BleepingComputer（本欄目按 intake 資料於 2026 年 10 月 23 日編發；CVE、CVSS 與版本對照請以 HPE 官方安全公告為準）。
English version
HPE patches 72 ArubaOS flaws at once, eight of them rated maximum severity
Hewlett Packard Enterprise has released security updates covering 72 vulnerabilities in the Aruba Operating System, including eight rated at maximum severity — a set of authentication bypass and remote code execution (RCE) issues. According to BleepingComputer, the flaws affect Aruba controllers and gateways.
These devices typically sit at the network edge facing outward, so once a flaw is exploitable the exposed surface becomes a ready-made way in. Teams running Aruba controllers and gateways should check their current firmware against the affected-version table in HPE's own advisory and schedule the upgrade into an upcoming maintenance window.
Why this batch matters
- Volume and severity: 72 flaws disclosed in a single release, eight of them at maximum severity, spanning authentication bypass and RCE — both of which can lead directly to unauthorised access or arbitrary code execution.
- Attack scenarios: an authentication bypass lets an attacker pass authentication without valid credentials, while RCE means running arbitrary code on the device. Whether each of the eight critical bugs requires prior authentication or can be triggered from outside must be read from the fields of HPE's advisory itself.
- Asset position: controllers and gateways commonly serve campus and branch networks, handling site-wide access and traffic, and some deployments expose management interfaces to the internet.
Suggested sequence
- Inventory: list every Aruba controller and gateway and record its current ArubaOS version.
- Get authoritative data: CVE identifiers, CVSS scores, and the affected/fixed version mapping should be taken from HPE's advisory; the BleepingComputer summary does not itemise them.
- Target the right fix: move to the fixed release for the affected branch rather than simply chasing the newest version — cross-major upgrades on network gear with tight maintenance windows carry extra risk.
- Review exposure: check how open the management interfaces are and remove unnecessary external access.
- Track follow-up status: watch CISA's KEV catalogue for these identifiers as a signal of exploitation risk. The source report did not describe any in-the-wild exploitation; not mentioning it is not the same as confirming it does not exist.
Why patches keep slipping
Controllers are core components that affect an entire site, maintenance windows are rare, and upgrades can drop existing connections — so "next quarter" becomes the default. But when a flaw involves authentication bypass or unauthenticated RCE, and the target faces the internet, delay itself widens the exposure. A single release of 72 flaws is a good moment to revisit how network OS patching is scheduled.
Source: BleepingComputer (compiled on 23 October 2026 per intake notes; CVE, CVSS, and version mappings refer to HPE's official advisory).