---
id: "CVE-2026-79846"
kind: "vulnerability"
aliases: ["CVE-2026-79846"]
title: "HPE Aruba AOS-8 controllers: unauthenticated remote command injection on the host"
severity: "critical"
cvss: 10.0
epss: 0.0137
exploited: false
status: "resolved"
category: "infrastructure"
products: [{"name": "AOS-8 8.13", "fixed": ["8.13.3.1"], "affected": ">= 8.13.0.0, <= 8.13.3.0", "ecosystem": "vendor"}, {"name": "AOS-8 8.10", "fixed": ["8.10.0.24"], "affected": ">= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe", "infrastructure", "mobility-conductor", "mobility-controller", "network-appliance"]
not_affected_if: ["unknown"]
published_at: "2026-10-22T19:17:56+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79846", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:01:51+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79846", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-8 controllers: unauthenticated remote command injection on the host

Certain interfaces in HPE Aruba AOS-8 mobility controllers and conductors accept input that is passed to the operating system shell. An unauthenticated remote attacker can run arbitrary commands on the underlying host when outside preconditions are met.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-8 8.13 affected >= 8.13.0.0, <= 8.13.3.0 fixed 8.13.3.1
- vendor:AOS-8 8.10 affected >= 8.10.0.0, <= 8.10.0.23 fixed 8.10.0.24

## How to check

Check the AOS-8 version with the show version command; affected builds are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23.

## Fix

Upgrade AOS-8 8.13 to 8.13.3.1 or AOS-8 8.10 to 8.10.0.24.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79846
- 2026-10-23T22:01:51+00:00 analyst — Vendor bulletin HPESBNW05162 (JS page, text not retrievable; versions from CVE.org record + secondary reports of HPE CSAF). No exploitation or PoC known per HPE as of Oct 22; not in KEV. Lower bound of 8.13 range differs: CVE.org says 8.13.0.0, CSAF per blog says 8.12.0.0. Interface and preconditions not disclosed by HPE.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79846

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] CVE Record: CVE-2026-79846 https://www.cve.org/CVERecord?id=CVE-2026-79846
- [fix] HPE Aruba AOS 8 and AOS 10: Patch Eight CVSS 10.0 Flaws Now https://theitguysfix.com/2026/10/23/hpe-aruba-aos-8-aos-10-eight-cvss-10-flaws-october-2026/
- [mitigation] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_