--- id: "CVE-2026-79844" kind: "vulnerability" aliases: ["CVE-2026-79844"] title: "HPE Aruba AOS-10: auth bypass lets unauthenticated attackers run OS commands" severity: "critical" cvss: 10.0 epss: 0.00689 exploited: false status: "open" category: "infrastructure" products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["aos-10", "aruba", "auth-bypass", "hpe", "infrastructure", "network-appliance", "rce", "wireless"] not_affected_if: ["version-outside-affected-ranges"] published_at: "2026-10-22T19:17:56+00:00" first_seen_at: "2026-10-23T21:57:31+00:00" updated_at: "2026-10-25T12:38:51+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79844", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:02:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:47:09+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79844", "first_seen_at": "2026-10-24T07:15:51+00:00"}] --- # HPE Aruba AOS-10: auth bypass lets unauthenticated attackers run OS commands HPE Aruba AOS-10 wireless controllers have authentication bypass flaws in an interface that can be reached remotely. A remote attacker with no credentials can run arbitrary commands on the underlying operating system if certain outside conditions are met. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:AOS-10 affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14 ## How to check Check the AOS-10 version on every Mobility Conductor, Controller, Gateway and AP (show version on the CLI, or the management UI). Affected: 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13. Per Rescana's reading of HPE's CSAF, the 10.6 and 10.3 branches and End-of-Maintenance/End-of-Support releases are also affected or presumed affected. Also check whether the CLI, web management interfaces or PAPI (UDP 8211) are reachable from untrusted networks. HPE has published no indicators of compromise; review accounting and audit logs for unexpected admin logins or config changes. ## Fix Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later, depending on branch. Until then, restrict the CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall them at layer 3 and above, with accounting and logging (HPE workaround). For Central-managed gateways, confirm who applies the upgrade. ## Timeline - 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79844 - 2026-10-23T22:02:59+00:00 analyst — HPE bulletin HPESBNW05162 (22 Oct 2026) page text was not readable by web-cli; versions and workaround come from the CVE record (affected ranges via cve.org search snippet), BleepingComputer, and Rescana quoting the bulletin, CERT-FR. HPE: no known exploitation or public PoC; not in KEV. Preconditions and the specific interface are not stated by HPE (unknown); Rescana also says so. Bug bounty or internal discovery. Re-check if HPE revises the bulletin. - 2026-10-23T22:47:09+00:00 analyst — No new sources since run 160; the triage rewrite had cleared how_to_check and the workaround, so I restored them. HPE still does not name the interface or the preconditions (Rescana says the same); the bulletin page is unreadable by web-cli, so that stays unknown. No exploitation or PoC known. - 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79844 ## Documents - [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US - [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/ - [mitigation] Rescana: HPESBNW05162 CVE-2026-79844 and seven more 10.0 flaws https://www.rescana.com/post/hpe-aruba-aos-cve-2026-79844-critical-october-2026 ## From the sources Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_