{"id":"CVE-2026-79850","kind":"vulnerability","aliases":["CVE-2026-79850"],"related":[],"title":"HPE Aruba AOS-8: unauthenticated attacker runs root commands on wireless controllers","description":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.","summary":"HPE Aruba AOS-8 wireless controllers have an interface flaw that lets an unauthenticated remote attacker bypass authentication. The attacker can then run arbitrary commands as root on the underlying host, which means full compromise of the controller.","severity":"critical","cvss":10.0,"epss":0.00689,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.10.0.24","8.13.3.1"],"affected":"<= 8.10.0.23, 8.13.x <= 8.13.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","auth-bypass","hpe","infrastructure","network-appliance","rce","self-hosted","wireless","wireless-controller"],"not_affected_if":["unpatched-version-not-in-range"],"how_to_check":"Check the installed AOS-8 version on each controller (show version) and compare it to affected versions 8.10.0.23 and earlier and 8.13.x up to 8.13.3.0.","fix":"Upgrade AOS-8 to 8.10.0.24 or 8.13.3.1, the fixed versions.","status":"open","published_at":"2026-10-22T19:17:57+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:06+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:32:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 to 8.10.0.24 or 8.13.3.1, the fixed versions.\nUnknown whether a workaround exists; check the HPE advisory.","reach":"network","title":"HPE Aruba AOS-8: unauthenticated attacker runs root commands on wireless controllers","impact":"high","summary":"HPE Aruba AOS-8 wireless controllers have an interface flaw that lets an unauthenticated remote attacker bypass authentication. The attacker can then run arbitrary commands as root on the underlying host, which means full compromise of the controller.","category":"infrastructure","who_cares":["aos-8","aruba","wireless-controller","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs commands as root on the controller, full system takeover","analyst_note":"Confirm which interface is affected and whether it is exposed by default, using the HPE Aruba advisory linked from the NVD entry.","how_to_check":"Check the installed AOS-8 version on each controller (show version) and compare it to affected versions 8.10.0.23 and earlier and 8.13.x up to 8.13.3.0.","needs_analyst":true,"not_affected_if":["unpatched-version-not-in-range"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3023,"output_tokens":479,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not name the affected interface, versions or vendor patch; check the NVD entry and the vendor security advisory for AOS-8 affected versions and fixed builds.","search":"'-2026':14A,17A '-79850':15A,18A '-8':4A,20A,22B,43B,85C 'affect':81C 'allow':87C,108C 'ao':3A,21B,42B,84C 'aos':19A 'applianc':31B 'arbitrari':63B,99C,113C 'aruba':2A,23B,41B 'attack':6A,55B,59B,91C,110C 'auth':25B 'auth-bypass':24B 'authent':57B,95C 'bypass':26B,56B,93C 'command':9A,64B,100C,114C 'complet':124C 'compromis':74B,126C 'control':12A,39B,45B,77B,96C 'could':86C,107C 'cve':13A,16A 'execut':112C 'exist':94C 'exploit':106C 'flaw':49B 'full':73B 'host':35B,70B,104C 'hpe':1A,27B,40B 'infrastructur':28B 'interfac':48B,82C 'lead':122C 'let':51B 'mean':72B 'network':30B 'network-appli':29B 'oper':120C 'rce':32B 'remot':54B,90C 'root':8A,66B,116C 'run':7A,62B,98C 'self':34B 'self-host':33B 'success':105C 'system':121C,125C 'unauthent':5A,53B,89C 'under':69B,103C,119C 'vulner':78C 'wireless':11A,36B,38B,44B 'wireless-control':37B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79850","severity":null,"published_at":"2026-10-22T19:17:57+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79850:153","url":null,"severity":null,"published_at":"2026-10-23T22:01:50+00:00","modified_at":"2026-10-23T22:01:50+00:00","first_seen_at":"2026-10-23T22:01:50+00:00","fetched_at":"2026-10-23T22:01:50+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026) via BleepingComputer; HPE page itself rendered empty so affected/fixed versions come from secondary report (hackersradar), not verified on the primary. HPE: no known PoC or exploitation. Did not search social posts."},{"source":"epss","external_id":"CVE-2026-79850","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79850","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1273,"url":"https://hackersradar.com/hpe-warns-critical-aruba-networking-flaws-let-attackers-take-control/","title":"HPE Warns Critical Aruba Networking Flaws (fixed versions)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}