{"id":"CVE-2026-79874","kind":"vulnerability","aliases":["CVE-2026-79874"],"related":[],"title":"HPE Aruba AOS-10: API authentication bypass gives adjacent attackers admin access","description":"An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","summary":"HPE Aruba AOS-10 network controllers have an API flaw that lets an unauthenticated attacker on an adjacent network get past authentication. A successful attacker could gain administrative access, change configuration and read or alter sensitive data.","severity":"critical","cvss":9.3,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adjacent-network","aos-10","aruba","auth-bypass","hpe-aruba","hpe-networking","infrastructure","network-gear","self-hosted"],"not_affected_if":["api-not-reachable-from-adjacent-network","version-outside-affected-ranges"],"how_to_check":"Run 'show version' on the AOS-10 controller or check the version in the web UI and compare it with the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13.","fix":"Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14 (or later in the same branch).\nUntil patched, restrict access to the AOS-10 API to trusted management networks: unknown for exact config commands.","status":"open","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:47+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14 (or later in the same branch).\nUntil patched, restrict access to the AOS-10 API to trusted management networks: unknown for exact config commands.","reach":"network","title":"HPE Aruba AOS-10: API authentication bypass gives adjacent attackers admin access","impact":"high","summary":"HPE Aruba AOS-10 network controllers have an API flaw that lets an unauthenticated attacker on an adjacent network get past authentication. A successful attacker could gain administrative access, change configuration and read or alter sensitive data.","category":"infrastructure","who_cares":["aos-10","hpe-aruba","network-gear","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gains administrative control of the network controller and its configuration.","analyst_note":"Confirm the exact CLI or UI command to show the AOS-10 version and whether the API is enabled by default, using the HPE Aruba security advisory for CVE-2026-79874.","how_to_check":"Run 'show version' on the AOS-10 controller or check the version in the web UI and compare it with the affected ranges: 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, 10.4.0.0 to 10.4.1.13.","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges","api-not-reachable-from-adjacent-network"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000587,"input_tokens":3051,"output_tokens":564,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected AOS-10 versions and patched release; the NVD entry alone has no version or fix details.","search":"'-10':4A,20A,25B,46B,88C '-2026':14A,17A '-79874':15A,18A 'access':12A,71B,108C,113C 'adjac':9A,22B,60B,92C 'adjacent-network':21B 'admin':11A 'administr':70B,107C 'allow':89C,102C 'alter':77B 'ao':3A,24B,45B,87C 'aos':19A 'api':5A,51B,85C 'aruba':2A,26B,32B,44B 'attack':10A,57B,67B,93C,104C 'auth':28B 'auth-bypass':27B 'authent':6A,64B,81C,97C 'bypass':7A,29B,82C 'chang':72B 'circumv':95C 'configur':73B,111C 'control':48B,98C 'could':68B,101C 'cve':13A,16A 'data':79B,117C 'exist':96C 'exploit':100C 'flaw':52B 'gain':69B,106C 'gear':39B 'get':62B 'give':8A 'host':42B 'hpe':1A,31B,34B,43B 'hpe-aruba':30B 'hpe-network':33B 'infrastructur':36B 'let':54B 'manipul':115C 'modifi':109C 'network':23B,35B,38B,47B,61B 'network-gear':37B 'past':63B 'read':75B 'self':41B 'self-host':40B 'sensit':78B,116C 'success':66B,99C 'system':110C 'unauthent':56B,91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79874","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79874:186","url":null,"severity":null,"published_at":"2026-10-23T22:14:42+00:00","modified_at":"2026-10-23T22:14:42+00:00","first_seen_at":"2026-10-23T22:14:42+00:00","fetched_at":"2026-10-23T22:14:42+00:00","note":"Read HPE advisory HPESBNW05162 (2026-Oct-22): CVE-2026-79874 is API auth bypass in AOS-10, adjacent attacker, CVSS 9.3. Fixed versions from advisory. HPE says no known exploitation or public PoC; no social search done (not needed, fresh disclosure)."},{"source":"epss","external_id":"CVE-2026-79874","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79874","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}