---
id: "CVE-2026-79871"
kind: "vulnerability"
aliases: ["CVE-2026-79871"]
title: "Aruba AOS-10: unauthenticated CLI flaw leaks data that enables further network access"
severity: "critical"
cvss: 9.6
epss: 0.00247
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-10", "aruba", "hpe", "infrastructure", "network-gear"]
not_affected_if: ["unknown"]
published_at: "2026-10-22T19:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79871", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:15:47+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79871", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-10: unauthenticated CLI flaw leaks data that enables further network access

AOS-10 wireless controllers have a command line interface flaw that exposes sensitive information to remote users. An unauthenticated attacker can retrieve that data and use it to reach other network services that AOS-10 supports.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Run 'show version' on the controller and compare against the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, or 10.4.0.0 to 10.4.1.13.

## Fix

Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14 (whichever matches your branch).

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79871
- 2026-10-23T22:15:47+00:00 analyst — Correction: removed the not-affected-if tag I added in the previous write. HPE names no condition that makes a device safe, so I have no basis for one.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79871

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] CVE Record: CVE-2026-79871 https://www.cve.org/CVERecord?id=CVE-2026-79871
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_