Live › vulnerability › CVE-2026-79864
Go to dashboardHPE Aruba AOS-10 network gear has a command injection flaw in an interface that takes no login. An attacker on an adjacent network can run arbitrary commands as a privileged user on the underlying operating system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-10 | vendor | >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
Check the AOS-10 version running on each gateway or controller against the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, and 10.4.0.0 to 10.4.1.13.
Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, matching your release train.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79864")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.