{"id":"CVE-2026-79868","kind":"vulnerability","aliases":["CVE-2026-79868"],"related":[],"title":"AOS-8 wireless controller: authentication bypass grants full administrative control","description":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.","summary":"Authentication bypass in an unnamed interface of AOS-8 (Mobility Conductors, Controllers, Instant APs). An unauthenticated attacker on an adjacent network (AV:A) can get admin access, change configuration, and read or change sensitive data. CVSS 9.6. Found internally by HPE; no known exploitation or public PoC.","severity":"critical","cvss":9.6,"epss":0.0022,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","auth-bypass","hpe","infrastructure","network-appliance","wireless-controller"],"not_affected_if":["aos-10-only"],"how_to_check":"Run 'show version' on each Mobility Conductor, Controller or Instant AP. You are exposed on 8.13.x at 8.13.3.0 or below, or on 8.10.x at 8.10.0.23 or below. EoM releases are presumed affected.","fix":"Upgrade to AOS-8 8.13.3.1 or later (8.13 train), or 8.10.0.24 or later (8.10 train). Workaround: restrict CLI and web management to a dedicated layer 2 segment/VLAN, apply layer 3+ firewall rules, and enable accounting.","status":"open","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:50+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8 wireless controller: authentication bypass grants full administrative control","impact":"high","summary":"AOS-8 wireless controllers have an authentication bypass in an affected interface. An unauthenticated attacker on an adjacent network can get administrative access, change configuration, and read or change sensitive data.","category":"infrastructure","who_cares":["aos-8","wireless-controller","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains administrative control of the wireless controller and its configuration","analyst_note":"Find the vendor advisory for CVE-2026-79868 to get affected AOS-8 versions, the affected interface, and the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000458,"input_tokens":2951,"output_tokens":326,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-79868 to get affected AOS-8 versions, the affected interface, and the fixed release.","search":"'-2026':12A,15A '-79868':13A,16A '-8':2A,20A,22B,43B,91C '9.6':71B 'access':61B,112C,117C 'adjac':54B,96C 'admin':60B 'administr':9A,111C 'affect':87C,128C 'allow':93C,106C 'ao':1A,21B,42B,90C 'aos':19A 'ap':48B 'applianc':31B 'aruba':23B 'attack':51B,97C,108C 'auth':25B 'auth-bypass':24B 'authent':5A,35B,82C,101C 'av':56B 'bypass':6A,26B,36B,83C 'chang':62B,67B 'circumv':99C 'complet':124C 'compromis':125C 'conductor':45B 'configur':63B,115C 'control':4A,10A,34B,46B,102C 'could':92C,105C 'cve':11A,14A 'cvss':70B 'data':69B,121C 'exist':100C 'exploit':78B,104C 'found':72B 'full':8A 'gain':110C 'get':59B 'grant':7A 'hpe':17A,27B,75B 'infrastructur':28B 'instant':47B 'interfac':40B,88C 'intern':73B 'known':77B 'lead':122C 'manipul':119C 'mobil':44B 'modifi':113C 'network':30B,55B 'network-appli':29B 'networking':18A 'poc':81B 'public':80B 'read':65B 'sensit':68B,120C 'success':103C 'system':114C,129C 'unauthent':50B,95C 'unnam':39B 'vulner':84C 'wireless':3A,33B 'wireless-control':32B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79868","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79868:290","url":null,"severity":null,"published_at":"2026-10-23T22:45:12+00:00","modified_at":"2026-10-23T22:45:12+00:00","first_seen_at":"2026-10-23T22:45:12+00:00","fetched_at":"2026-10-23T22:45:12+00:00","note":"Part of HPE bulletin HPESBNW05162 (2026-10-22, 72 CVEs). Affected/fixed versions from signed advisory text and CVE record. The advisory only says 'affected interface' for this CVE; the interface is not named in the part I read (text was truncated). HPE reports no exploitation and no public PoC; I did not search X or other discussion."},{"source":"epss","external_id":"CVE-2026-79868","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79868","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1594,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79868","title":"CVE Record: CVE-2026-79868","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}