{"id":"CVE-2026-79846","kind":"vulnerability","aliases":["CVE-2026-79846"],"related":[],"title":"HPE Aruba AOS-8 controllers: unauthenticated remote command injection on the host","description":"Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","summary":"Certain interfaces in HPE Aruba AOS-8 mobility controllers and conductors accept input that is passed to the operating system shell. An unauthenticated remote attacker can run arbitrary commands on the underlying host when outside preconditions are met.","severity":"critical","cvss":10.0,"epss":0.0137,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8 8.13","fixed":["8.13.3.1"],"affected":">= 8.13.0.0, <= 8.13.3.0","ecosystem":"vendor"},{"name":"AOS-8 8.10","fixed":["8.10.0.24"],"affected":">= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","mobility-conductor","mobility-controller","network-appliance"],"not_affected_if":["unknown"],"how_to_check":"Check the AOS-8 version with the show version command; affected builds are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23.","fix":"Upgrade AOS-8 8.13 to 8.13.3.1 or AOS-8 8.10 to 8.10.0.24.","status":"resolved","published_at":"2026-10-22T19:17:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:08+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:32:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 8.13 to 8.13.3.1 or AOS-8 8.10 to 8.10.0.24.\nunknown","reach":"network","title":"HPE Aruba AOS-8 controllers: unauthenticated remote command injection on the host","impact":"high","summary":"Certain interfaces in HPE Aruba AOS-8 mobility controllers and conductors accept input that is passed to the operating system shell. An unauthenticated remote attacker can run arbitrary commands on the underlying host when outside preconditions are met.","category":"infrastructure","who_cares":["aos-8","aruba","mobility-controller","mobility-conductor"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands as the controller's underlying OS user","analyst_note":"Sources do not name the affected interface or the preconditions; check the HPE Aruba security bulletin for the exact interface and mitigation steps.","how_to_check":"Check the AOS-8 version with the show version command; affected builds are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23.\nunknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3062,"output_tokens":471,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-79846 (HPE/Aruba security bulletin) to confirm affected AOS-8 versions, the exact interface, the preconditions, and the patched release.","search":"'-2026':14A,17A '-79846':15A,18A '-8':4A,20A,23A,26B,45B,87C '8.10':24A '8.13':21A 'accept':50B 'affect':83C 'allow':90C,117C 'ao':3A,25B,44B,86C 'aos':19A,22A 'applianc':38B 'arbitrari':66B,97C,122C 'aruba':2A,27B,43B 'attack':63B,94C,109C,119C 'certain':39B,104C 'command':8A,67B,77C,98C,123C 'conductor':32B,49B 'control':5A,35B,47B,111C 'could':89C,116C 'cve':13A,16A 'execut':121C 'exist':80C 'exploit':115C 'host':12A,71B,102C 'hpe':1A,28B,42B 'infrastructur':29B 'inject':9A,78C 'input':51B 'interfac':40B,84C 'met':76B,113C 'mobil':31B,34B,46B 'mobility-conductor':30B 'mobility-control':33B 'network':37B 'network-appli':36B 'oper':57B,127C 'outsid':73B,106C 'pass':54B 'precondit':74B,105C 'remot':7A,62B,93C 'run':65B,96C 'shell':59B 'success':114C 'system':58B,128C 'unauthent':6A,61B,92C 'under':70B,101C,126C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79846","severity":null,"published_at":"2026-10-22T19:17:56+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79846:156","url":null,"severity":null,"published_at":"2026-10-23T22:01:51+00:00","modified_at":"2026-10-23T22:01:51+00:00","first_seen_at":"2026-10-23T22:01:51+00:00","fetched_at":"2026-10-23T22:01:51+00:00","note":"Vendor bulletin HPESBNW05162 (JS page, text not retrievable; versions from CVE.org record + secondary reports of HPE CSAF). No exploitation or PoC known per HPE as of Oct 22; not in KEV. Lower bound of 8.13 range differs: CVE.org says 8.13.0.0, CSAF per blog says 8.12.0.0. Interface and preconditions not disclosed by HPE."},{"source":"epss","external_id":"CVE-2026-79846","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79846","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1274,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79846","title":"CVE Record: CVE-2026-79846","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1275,"url":"https://theitguysfix.com/2026/10/23/hpe-aruba-aos-8-aos-10-eight-cvss-10-flaws-october-2026/","title":"HPE Aruba AOS 8 and AOS 10: Patch Eight CVSS 10.0 Flaws Now","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}