HPE Patches Eight Maximum-Severity RCE and Auth Bypass Flaws in ArubaOS
72 vulnerabilities addressed in latest security update cycle
Key Takeaways
- HPE has released security updates patching 72 vulnerabilities in ArubaOS
- Eight flaws are rated maximum severity, enabling unauthenticated remote code execution and authentication bypass
- Successful exploitation could allow full system compromise of affected ArubaOS devices
- No public exploitation confirmed at time of reporting, but maximum-severity flaws are high-risk targets
Related Security News
Researchers Disarm Vulnerable Updater in Abandoned Time4Popcorn App
Security researchers have remotely disabled a vulnerable updater component in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client. The flaw could have allowed attackers to execute malicious code with elevated privileges on millions of Windows computers. The intervention closed the security gap before active exploitation was reported.
Siemens Releases Patches for Two Vulnerabilities in .NET Client Library for SIMATIC S7 Webserver API
Siemens ProductCERT, in coordination with CISA, has disclosed two vulnerabilities in the .NET Client Library for SIMATIC S7 Webserver API. CVE-2026-85114 is a path traversal flaw that could allow an attacker to write arbitrary files outside the intended download directory. CVE-2026-85115 fails to redact PLC restore passwords from HTTP error messages, potentially exposing credentials. Siemens has released updated library versions (v3.3.61 and v3.3.62) addressing the respective issues. No confirmed active exploitation has been reported as of the advisory publication date.