{"id":"CVE-2026-79867","kind":"vulnerability","aliases":["CVE-2026-79867"],"related":[],"title":"Aruba AOS-8 controllers: authentication bypass lets adjacent attackers run host commands","description":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.","summary":"HPE Aruba AOS-8 wireless controllers have an authentication bypass in an interface that lets an unauthenticated attacker on the adjacent network run arbitrary commands on the underlying operating system. The sources say this leads to complete system compromise.","severity":"critical","cvss":9.6,"epss":0.0024,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe-networking","infrastructure","network-appliance","wireless-controller"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"Check the AOS-8 version running on each controller against the affected ranges: 8.13.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23.","fix":"Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, the fixed versions listed for each branch.","status":"open","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:52+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:31:52Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, the fixed versions listed for each branch.\nunknown","reach":"network","title":"Aruba AOS-8 controllers: authentication bypass lets adjacent attackers run host commands","impact":"high","summary":"HPE Aruba AOS-8 wireless controllers have an authentication bypass in an interface that lets an unauthenticated attacker on the adjacent network run arbitrary commands on the underlying operating system. The sources say this leads to complete system compromise.","category":"infrastructure","who_cares":["aos-8","aruba","hpe-networking","wireless-controller"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs commands as root on the controller host.","analyst_note":"Sources do not say which interface is affected or whether it is exposed by default; check the HPE Aruba security bulletin for the affected interface and any workaround.","how_to_check":"Check the AOS-8 version running on each controller against the affected ranges: 8.13.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23.","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3041,"output_tokens":475,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD record; find the vendor advisory for the affected AOS-8 versions, the affected interface, and the patched release.","search":"'-2026':14A,17A '-79867':15A,18A '-8':3A,20A,22B,37B,82C 'adjac':8A,54B,87C 'affect':78C 'allow':84C,105C 'ao':2A,21B,36B,81C 'aos':19A 'applianc':30B 'arbitrari':57B,96C,110C 'aruba':1A,23B,35B 'attack':9A,51B,88C,107C 'authent':5A,42B,73C,92C 'bypass':6A,43B,74C 'circumv':90C 'command':12A,58B,97C,111C 'complet':70B,119C 'compromis':72B,121C 'control':4A,33B,39B,93C 'could':83C,104C 'cve':13A,16A 'execut':109C 'exist':91C 'exploit':103C 'host':11A,101C 'hpe':25B,34B 'hpe-network':24B 'infrastructur':27B 'interfac':46B,79C 'lead':68B,117C 'let':7A,48B 'network':26B,29B,55B 'network-appli':28B 'oper':62B,115C 'run':10A,56B,95C 'say':66B 'sourc':65B 'success':102C 'system':63B,71B,116C,120C 'unauthent':50B,86C 'under':61B,100C,114C 'vulner':75C 'wireless':32B,38B 'wireless-control':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79867","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79867:192","url":null,"severity":null,"published_at":"2026-10-23T22:15:52+00:00","modified_at":"2026-10-23T22:15:52+00:00","first_seen_at":"2026-10-23T22:15:52+00:00","fetched_at":"2026-10-23T22:15:52+00:00","note":"Triage said Alcatel-Lucent; wrong: it is HPE Networking (Aruba) AOS-8, bulletin HPESBNW05162 (2026-10-22), read on the vendor CSAF text. Not exploited, no public PoC per HPE. Per-CVE text paraphrased via WebFetch (web-cli text truncated before it). No social search done."},{"source":"epss","external_id":"CVE-2026-79867","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79867","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}