Live › vulnerability › CVE-2026-79846
Go to dashboardCertain interfaces in HPE Aruba AOS-8 mobility controllers and conductors accept input that is passed to the operating system shell. An unauthenticated remote attacker can run arbitrary commands on the underlying host when outside preconditions are met.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-8 8.13 | vendor | >= 8.13.0.0, <= 8.13.3.0 | 8.13.3.1 |
| AOS-8 8.10 | vendor | >= 8.10.0.0, <= 8.10.0.23 | 8.10.0.24 |
Check the AOS-8 version with the show version command; affected builds are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23.
Upgrade AOS-8 8.13 to 8.13.3.1 or AOS-8 8.10 to 8.10.0.24.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79846")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.