---
id: "CVE-2026-79867"
kind: "vulnerability"
aliases: ["CVE-2026-79867"]
title: "Aruba AOS-8 controllers: authentication bypass lets adjacent attackers run host commands"
severity: "critical"
cvss: 9.6
epss: 0.0024
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe-networking", "infrastructure", "network-appliance", "wireless-controller"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-22T19:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79867", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:15:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79867", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-8 controllers: authentication bypass lets adjacent attackers run host commands

HPE Aruba AOS-8 wireless controllers have an authentication bypass in an interface that lets an unauthenticated attacker on the adjacent network run arbitrary commands on the underlying operating system. The sources say this leads to complete system compromise.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-8 affected >= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

Check the AOS-8 version running on each controller against the affected ranges: 8.13.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23.

## Fix

Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, the fixed versions listed for each branch.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79867
- 2026-10-23T22:15:52+00:00 analyst — Triage said Alcatel-Lucent; wrong: it is HPE Networking (Aruba) AOS-8, bulletin HPESBNW05162 (2026-10-22), read on the vendor CSAF text. Not exploited, no public PoC per HPE. Per-CVE text paraphrased via WebFetch (web-cli text truncated before it). No social search done.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79867

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [fix] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_