The facts
The verified HPE-issued records are CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850 and CVE-2026-79851, published on 22 October. [1][2][3][4][5][6][7]
The records describe authentication bypass, command injection, SQL injection and buffer overflows. Some attack paths require additional conditions outside the attacker’s control. [1][2][3][4][5][6][7]
SecurityWeek reports fixes in releases 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7 and 10.8.1.2, and vendor guidance to isolate management interfaces. [8]
As of SecurityWeek’s 27 October report, HPE said it was unaware of active exploitation. That is a vendor statement, not proof that exploitation has not occurred. [8]
Sources
References support the numbered facts above. Source checks: 29 Oct 2026, 05:36 UTC.
Seven HPE-issued CVE records were read directly. The vendor support page returned no readable bulletin text; fixed-release guidance is attributed to SecurityWeek. The incident date is the disclosure date, not this catch-up publication.
- HPE-issued record CVE-2026-79844
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE-issued record CVE-2026-79846
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE-issued record CVE-2026-79847
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE-issued record CVE-2026-79848
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE-issued record CVE-2026-79849
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE-issued record CVE-2026-79850
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE-issued record CVE-2026-79851
HPE CNA via the CVE Program · Primary source · 22 Oct 2026
- HPE Patches Dozens of Critical Flaws in Networking Products
SecurityWeek · Reporting · 27 Oct 2026