--- title: "HPE Patched 72 Flaws in the Wi-Fi OS Behind Its 139% Rally" description: "Eight of the flaws carry the maximum severity score and are reachable over a network with no credentials. The division's president sold $2.0 million of stock the day before the bulletin, under a plan set months earlier. The open question is whether enterprise Wi-Fi buyers start pricing a vendor's patch record." publisher: "The Inference" section: "Security" published: 2026-10-24T16:08:01.751Z modified: 2026-10-24T16:08:01.751Z canonical: https://theinference.org/article/hpe-patched-72-flaws-in-the-wi-fi-os-behind-its-139-rally language: en keywords: "Cybersecurity, Vulnerabilities, HPE, Networking, Stocks" --- # HPE Patched 72 Flaws in the Wi-Fi OS Behind Its 139% Rally > Eight of the flaws carry the maximum severity score and are reachable over a network with no credentials. The division's president sold $2.0 million of stock the day before the bulletin, under a plan set months earlier. The open question is whether enterprise Wi-Fi buyers start pricing a vendor's patch record. [Hewlett Packard Enterprise](https://theinference.org/markets/companies/hewlett-packard-enterprise) (HPE) has gained 139% this year, and the rally rests on one division: networking, assembled from the Juniper acquisition after the Justice Department settled its challenge in June 2025 [1][2]. On October 22 that division [shipped a patch batch HPE had flagged a week in advance as "larger than usual"](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/): 72 vulnerabilities in ArubaOS, the operating system that runs the Wi-Fi controllers, gateways and access points inside enterprises [3][4]. HPE says it has seen no public exploit code and no sign the flaws are being used, and none of the 72 was in the known-exploited catalog kept by the Cybersecurity and Infrastructure Security Agency (CISA) as of October 23 [3][4]. That record [does not itself threaten the rally](https://theinference.org/article/f5-s-authentication-appliance-is-under-active-attack-and-shares-are-up-75-anyway). What the week tests is whether the people who buy enterprise Wi-Fi start weighing a vendor's patch record alongside price and performance. *Chart: **HPE has left both market benchmarks far behind this year** Bar chart of year-to-date returns: HPE 138.8%, QQQ 14.9%, S&P 500 12.0%* *Year-to-date returns as of October 23, 2026. Source: Trefis. [1]* ## The flaws are dormant, in the layer attackers are hitting hardest Eight of the 72 carry the maximum 10.0 score: authentication bypasses that end in remote code execution, plus unauthenticated SQL injection, command injection and buffer overflows [4]. All are reachable over a network with no privileges and no user interaction, and [CISA's assessment of the headline flaw](https://www.rescana.com/post/hpe-aruba-aos-cve-2026-79844-critical-october-2026) rates the attack automatable and the technical impact total, with exploitation so far as none [3]. That quiet has not lasted elsewhere this autumn. The infrastructure flaws exploited fastest [sat in management consoles](https://theinference.org/article/attackers-sat-inside-check-point-s-firewall-brain-for-two-months-the-stock-went-up), the software that configures network gear and holds its credentials; [Cisco](https://theinference.org/markets/companies/cisco)'s firewall-management and identity-engine flaws were [exploited in the days around their September disclosure](https://www.bleepingcomputer.com/news/security/infratrust-report-warns-network-management-systems-under-attack/) [6]. ArubaOS's weak spots sit in the same layer: the web management interface, the command line and PAPI, the protocol its access points speak [3]. HPE shipped a comparable batch of critical flaws in StoreOnce, its backup-appliance line, in June 2025, the second such drop inside 16 months [4]. ## Customers pay first; the president's sale was scheduled months ahead The first bill lands on customers running end-of-maintenance releases, versions HPE no longer updates: the bulletin lists no fix for them, only an instruction to move to a supported branch [3]. Everyone else spends an emergency patch week, with management interfaces locked to trusted network segments until it is done [3]. [Rami Rahim](https://theinference.org/markets/people/rami-rahim), who ran Juniper and now leads HPE Networking, [sold $2.0 million of stock on October 21](https://www.sec.gov/Archives/edgar/data/1645590/000156084926000013/0001560849-26-000013-index.htm), the day before the bulletin [5]. His trading plan was adopted on June 30, months before HPE's October 15 advance notice existed, and he kept the large majority of his holding [5]. The dates describe an ordinary scheduled sale. The governance line that does move is lobbying: HPE's bill [rose by about a third in a quarter, to $1.83 million](https://legis1.com/news/hpe-juniper-deal-boosts-lobbying-spend-amid-doj), while Democratic senators press the Justice Department's inspector general over the settlement [2]. ## Concentration protects the vendor and slows the buyer The complaint the Justice Department settled argued that HPE-Juniper, alongside Cisco, would control more than 70% of the United States enterprise wireless LAN market [2]. A buyer with few alternatives is more likely to absorb the patch week than to punish the vendor for it. That insulation is what lets a patch record like this one coexist with this year's run. *Chart: **HPE's quarterly revenue stepped up once Juniper consolidated** Line chart of HPE quarterly revenue across eight fiscal quarters, from $8.5 billion in the quarter ended October 2024 to $12.2 billion in the quarter ended July 2026, stepping up from late 2025* *Reported quarterly revenue, $ billions, labeled by HPE fiscal quarter; the fiscal year ends October 31, so FQ4 '24 ended October 2024. Source: HPE SEC filings. [8]* Demand itself is not in question. At HPE's [networking investor day on September 30](https://siliconangle.com/2026/09/30/five-takeaways-from-hpes-networking-investor-day/), campus and branch Wi-Fi, the office and remote-site networks this bulletin touches, was put at roughly half of networking revenue, with orders growing 3.5 times faster than revenue [7]. Rahim said from the same stage that some customer equipment "belongs in a museum," in a session where analysts argued AI now finds flaws faster than vendors patch them [7]. ## What would turn software quality into a price HPE has [raised its free-cash-flow target for the next fiscal year to at least $5 billion](https://www.trefis.com/stock/hpe/articles/620119/should-you-buy-hewlett-packard-enterprise-stock-for-its-cash/2026-10-23), and its fiscal fourth-quarter results, due in December, will show whether margins hold [1]. The shorter list sits with CISA: any of the eight crossing into the known-exploited catalog would hand procurement teams a documented reason to write patch cadence into contracts [3]. Demand has carried the stock this far. The catalog is the first place evidence to the contrary could appear. ## Takeaway HPE's networking division patched 72 ArubaOS flaws, eight of them maximum-severity and network-reachable without credentials, with no sign of exploitation so far. The 139% stock rally now rests partly on enterprise Wi-Fi buyers not pricing a vendor's patch record into contracts, and CISA's known-exploited catalog is the first place evidence against that would appear. ## Sources 1. [Trefis, "Should You Buy Hewlett Packard Enterprise Stock For Its Cash?", 23 October 2026](https://www.trefis.com/stock/hpe/articles/620119/should-you-buy-hewlett-packard-enterprise-stock-for-its-cash/2026-10-23) 2. [Legis1, "Hewlett Packard Enterprise Lobbying Rises Amid Antitrust Scrutiny", October 2026](https://legis1.com/news/hpe-juniper-deal-boosts-lobbying-spend-amid-doj) 3. [Rescana, "HPE Aruba Networking AOS-8 and AOS-10 Bulletin HPESBNW05162: CVE-2026-79844 and Seven More Flaws Rated 10.0, Patch Now", 23 October 2026](https://www.rescana.com/post/hpe-aruba-aos-cve-2026-79844-critical-october-2026) 4. [BleepingComputer, "HPE patches eight max severity RCE and auth bypass AOS flaws", 23 October 2026](https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/) 5. [US SEC Form 4, Rami Rahim (EVP, Pres GM Networking), Hewlett Packard Enterprise, filed 23 October 2026](https://www.sec.gov/Archives/edgar/data/1645590/000156084926000013/0001560849-26-000013-index.htm) 6. [BleepingComputer, "InfraTrust report warns network management systems under attack", 23 September 2026](https://www.bleepingcomputer.com/news/security/infratrust-report-warns-network-management-systems-under-attack/) 7. [SiliconANGLE, "Five takeaways from HPE's Networking Investor Day", 30 September 2026](https://siliconangle.com/2026/09/30/five-takeaways-from-hpes-networking-investor-day/) 8. [Hewlett Packard Enterprise, quarterly figures from its SEC filings, retrieved 24 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001645590) --- HPE Patched 72 Flaws in the Wi-Fi OS Behind Its 139% Rally — The Inference. Canonical: https://theinference.org/article/hpe-patched-72-flaws-in-the-wi-fi-os-behind-its-139-rally