---
id: "CVE-2026-79850"
kind: "vulnerability"
aliases: ["CVE-2026-79850"]
title: "HPE Aruba AOS-8: unauthenticated attacker runs root commands on wireless controllers"
severity: "critical"
cvss: 10.0
epss: 0.00689
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-8", "fixed": ["8.10.0.24", "8.13.3.1"], "affected": "<= 8.10.0.23, 8.13.x <= 8.13.3.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "auth-bypass", "hpe", "infrastructure", "network-appliance", "rce", "self-hosted", "wireless", "wireless-controller"]
not_affected_if: ["unpatched-version-not-in-range"]
published_at: "2026-10-22T19:17:57+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79850", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:01:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79850", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-8: unauthenticated attacker runs root commands on wireless controllers

HPE Aruba AOS-8 wireless controllers have an interface flaw that lets an unauthenticated remote attacker bypass authentication. The attacker can then run arbitrary commands as root on the underlying host, which means full compromise of the controller.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-8 affected <= 8.10.0.23, 8.13.x <= 8.13.3.0 fixed 8.10.0.24, 8.13.3.1

## How to check

Check the installed AOS-8 version on each controller (show version) and compare it to affected versions 8.10.0.23 and earlier and 8.13.x up to 8.13.3.0.

## Fix

Upgrade AOS-8 to 8.10.0.24 or 8.13.3.1, the fixed versions.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79850
- 2026-10-23T22:01:50+00:00 analyst — HPE bulletin HPESBNW05162 (22 Oct 2026) via BleepingComputer; HPE page itself rendered empty so affected/fixed versions come from secondary report (hackersradar), not verified on the primary. HPE: no known PoC or exploitation. Did not search social posts.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79850

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
- [fix] HPE Warns Critical Aruba Networking Flaws (fixed versions) https://hackersradar.com/hpe-warns-critical-aruba-networking-flaws-let-attackers-take-control/

## From the sources

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_