{"id":"CVE-2026-79844","kind":"vulnerability","aliases":["CVE-2026-79844"],"related":[],"title":"HPE Aruba AOS-10: auth bypass lets unauthenticated attackers run OS commands","description":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","summary":"HPE Aruba AOS-10 wireless controllers have authentication bypass flaws in an interface that can be reached remotely. A remote attacker with no credentials can run arbitrary commands on the underlying operating system if certain outside conditions are met.","severity":"critical","cvss":10.0,"epss":0.00689,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aruba","auth-bypass","hpe","infrastructure","network-appliance","rce","wireless"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"Check the AOS-10 version on every Mobility Conductor, Controller, Gateway and AP (show version on the CLI, or the management UI). Affected: 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13. Per Rescana's reading of HPE's CSAF, the 10.6 and 10.3 branches and End-of-Maintenance/End-of-Support releases are also affected or presumed affected. Also check whether the CLI, web management interfaces or PAPI (UDP 8211) are reachable from untrusted networks. HPE has published no indicators of compromise; review accounting and audit logs for unexpected admin logins or config changes.","fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later, depending on branch. Until then, restrict the CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall them at layer 3 and above, with accounting and logging (HPE workaround). For Central-managed gateways, confirm who applies the upgrade.","status":"open","published_at":"2026-10-22T19:17:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:08+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T22:32:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7, or 10.4.1.14, depending on the installed branch.","reach":"network","title":"HPE Aruba AOS-10: auth bypass lets unauthenticated attackers run OS commands","impact":"high","summary":"HPE Aruba AOS-10 wireless controllers have authentication bypass flaws in an interface that can be reached remotely. A remote attacker with no credentials can run arbitrary commands on the underlying operating system if certain outside conditions are met.","category":"infrastructure","who_cares":["aos-10","aruba","wireless","network-appliance"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated remote attacker runs arbitrary commands on the appliance OS.","analyst_note":"Sources do not say which interface is affected or which preconditions must hold; check the HPE security bulletin for the affected interface and a detection method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":3069,"output_tokens":414,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not say which interface is affected or which preconditions must hold; check the HPE security bulletin for the affected interface and a detection method.","search":"'-10':4A,20A,22B,37B,82C '-2026':14A,17A '-79844':15A,18A 'affect':78C 'allow':84C,111C 'ao':3A,21B,36B,81C 'aos':19A 'applianc':31B 'arbitrari':60B,91C,116C 'aruba':2A,23B,35B 'attack':9A,54B,88C,103C,113C 'auth':5A,25B 'auth-bypass':24B 'authent':41B,73C 'bypass':6A,26B,42B,74C 'certain':68B,98C 'command':12A,61B,92C,117C 'condit':70B 'control':39B,105C 'could':83C,110C 'credenti':57B 'cve':13A,16A 'execut':115C 'exploit':109C 'flaw':43B 'host':96C 'hpe':1A,27B,34B 'infrastructur':28B 'interfac':46B,79C 'let':7A 'met':72B,107C 'network':30B 'network-appli':29B 'oper':65B,121C 'os':11A 'outsid':69B,100C 'precondit':99C 'rce':32B 'reach':50B 'remot':51B,53B,87C 'run':10A,59B,90C 'success':108C 'system':66B,122C 'unauthent':8A,86C 'under':64B,95C,120C 'vulner':75C 'wireless':33B,38B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79844","severity":null,"published_at":"2026-10-22T19:17:56+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79844:160","url":null,"severity":null,"published_at":"2026-10-23T22:02:59+00:00","modified_at":"2026-10-23T22:02:59+00:00","first_seen_at":"2026-10-23T22:02:59+00:00","fetched_at":"2026-10-23T22:02:59+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026) page text was not readable by web-cli; versions and workaround come from the CVE record (affected ranges via cve.org search snippet), BleepingComputer, and Rescana quoting the bulletin, CERT-FR. HPE: no known exploitation or public PoC; not in KEV. Preconditions and the specific interface are not stated by HPE (unknown); Rescana also says so. Bug bounty or internal discovery. Re-check if HPE revises the bulletin."},{"source":"analyst","external_id":"CVE-2026-79844:298","url":null,"severity":null,"published_at":"2026-10-23T22:47:09+00:00","modified_at":"2026-10-23T22:47:09+00:00","first_seen_at":"2026-10-23T22:47:09+00:00","fetched_at":"2026-10-23T22:47:09+00:00","note":"No new sources since run 160; the triage rewrite had cleared how_to_check and the workaround, so I restored them. HPE still does not name the interface or the preconditions (Rescana says the same); the bulletin page is unreadable by web-cli, so that stays unknown. No exploitation or PoC known."},{"source":"epss","external_id":"CVE-2026-79844","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79844","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1292,"url":"https://www.rescana.com/post/hpe-aruba-aos-cve-2026-79844-critical-october-2026","title":"Rescana: HPESBNW05162 CVE-2026-79844 and seven more 10.0 flaws","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}