{"id":"CVE-2026-79864","kind":"vulnerability","aliases":["CVE-2026-79864"],"related":[],"title":"HPE Aruba AOS-10: unauthenticated command injection gives root on controllers","description":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","summary":"HPE Aruba AOS-10 network gear has a command injection flaw in an interface that takes no login. An attacker on an adjacent network can run arbitrary commands as a privileged user on the underlying operating system.","severity":"critical","cvss":9.6,"epss":0.01163,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adjacent-network","aos-10","aruba","hpe","infrastructure","network-gear"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"Check the AOS-10 version running on each gateway or controller against the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, and 10.4.0.0 to 10.4.1.13.","fix":"Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, matching your release train.","status":"open","published_at":"2026-10-22T19:17:58+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:53+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:53Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, matching your release train.\nunknown","reach":"network","title":"HPE Aruba AOS-10: unauthenticated command injection gives root on controllers","impact":"high","summary":"HPE Aruba AOS-10 network gear has a command injection flaw in an interface that takes no login. An attacker on an adjacent network can run arbitrary commands as a privileged user on the underlying operating system.","category":"infrastructure","who_cares":["aos-10","aruba","hpe","network-gear"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary commands as privileged OS user on device","analyst_note":"Confirm which AOS-10 interface is affected and whether it is reachable without a management-network restriction; check the HPE advisory for the exact mitigation and the how-to-check command.","how_to_check":"Check the AOS-10 version running on each gateway or controller against the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, and 10.4.0.0 to 10.4.1.13.\nunknown","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00055,"input_tokens":3040,"output_tokens":492,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-79864 to get affected AOS-10 versions, the vulnerable interface, and the patched release; NVD page lacks these.","search":"'-10':4A,19A,24B,34B,78C '-2026':13A,16A '-79864':14A,17A 'adjac':21B,53B,84C 'adjacent-network':20B 'affect':74C 'allow':81C,93C 'ao':3A,23B,33B,77C 'aos':18A 'arbitrari':57B,98C 'aruba':2A,25B,32B 'attack':50B,85C,95C 'command':6A,39B,58B,68C,88C,99C 'control':11A 'could':80C,92C 'cve':12A,15A 'execut':97C 'exist':71C 'exploit':91C 'flaw':41B 'gear':30B,36B 'give':8A 'hpe':1A,26B,31B 'infrastructur':27B 'inject':7A,40B,69C,89C 'interfac':44B,75C 'login':48B 'network':22B,29B,35B,54B 'network-gear':28B 'oper':66B,107C 'perform':87C 'privileg':61B,102C 'root':9A 'run':56B 'success':90C 'system':67B,108C 'take':46B 'unauthent':5A,83C 'under':65B,106C 'user':62B,103C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79864","severity":null,"published_at":"2026-10-22T19:17:58+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79864:197","url":null,"severity":null,"published_at":"2026-10-23T22:17:52+00:00","modified_at":"2026-10-23T22:17:52+00:00","first_seen_at":"2026-10-23T22:17:52+00:00","fetched_at":"2026-10-23T22:17:52+00:00","note":"Read HPE advisory HPESBNW05162 (CSAF text, truncated before this CVE's detail entry, so the exact interface is unnamed). Affected/fixed versions confirmed from its summary sections. No exploitation or public PoC per HPE and BleepingComputer; no social search done."},{"source":"epss","external_id":"CVE-2026-79864","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79864","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1374,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79864","title":"CVE Record CVE-2026-79864","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}