Live › vulnerability › CVE-2026-79855
Go to dashboardUnauthenticated SSH daemon authentication bypass in HPE Aruba AOS-8 (CWE-288, CVSS 9.8, AV:N/PR:N). It gives administrative access and full host compromise. It is one of 72 CVEs in bulletin HPESBNW05162, which covers both AOS-8 and AOS-10. HPE credits its internal researchers and says it knew of no public discussion or exploit code at release.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| HPE Aruba AOS-8 | vendor | <= 8.13.3.0, <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
show version on each Mobility Conductor, Mobility Controller and Instant AP8.13.3.0 or earlier, or 8.10.0.23 or earlier8.13.3.1 or 8.10.0.24, depending on your release branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.
This page as .md · .json · in your agent: get_signal("CVE-2026-79855")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.