---
id: "CVE-2026-79853"
kind: "vulnerability"
aliases: ["CVE-2026-79853"]
title: "HPE AOS-10 wireless controllers: unauthenticated info leak leads to command execution"
severity: "critical"
cvss: 9.8
epss: 0.00549
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["alcatel-lucent-enterprise", "aos-10", "aruba", "hpe", "hpe-aruba", "infrastructure", "network-gear", "wireless"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-22T19:17:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79853", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:21:35+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79853", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE AOS-10 wireless controllers: unauthenticated info leak leads to command execution

HPE Networking AOS-10 has an information disclosure flaw in an exposed interface that lets an unauthenticated remote attacker read sensitive data from the device. The sources say successful exploitation could also let an attacker run arbitrary commands on the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking AOS-10 affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Check the AOS-10 version on each controller or gateway against the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, and 10.4.0.0 to 10.4.1.13.

## Fix

Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, matching your branch.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79853
- 2026-10-23T22:21:35+00:00 analyst — Vendor is HPE Networking (Aruba), not Alcatel-Lucent Enterprise; advisory HPESBNW05162 (2026-10-22) lists fixed versions. Interface is not named in the advisory (only 'affected interface'). HPE: no known exploit or public PoC. Reporter moonv (bug bounty). Sibling of CVE-2026-79844..79874.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79853

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
- [fix] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [mentions] CVE Record: CVE-2026-79853 https://www.cve.org/CVERecord?id=CVE-2026-79853

## From the sources

Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_