Live › vulnerability › CVE-2026-79868
Go to dashboardAuthentication bypass in an unnamed interface of AOS-8 (Mobility Conductors, Controllers, Instant APs). An unauthenticated attacker on an adjacent network (AV:A) can get admin access, change configuration, and read or change sensitive data. CVSS 9.6. Found internally by HPE; no known exploitation or public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HPE Networking AOS-8 | vendor | >= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
show version on each Mobility Conductor, Controller or Instant AP8.13.3.0 or below, or on 8.10.x at 8.10.0.23 or below8.13.3.1 or later (8.13 train), or 8.10.0.24 or later (8.10 train)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79868")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.