Live › vulnerability › CVE-2026-79874
Go to dashboardHPE Aruba AOS-10 network controllers have an API flaw that lets an unauthenticated attacker on an adjacent network get past authentication. A successful attacker could gain administrative access, change configuration and read or alter sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-10 | vendor | >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
Run show version on the AOS-10 controller or check the version in the web UI and compare it with the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13.
10.8.1.2, 10.7.2.7, or 10.4.1.14 (or later in the same branch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
This page as .md · .json · in your agent: get_signal("CVE-2026-79874")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.