Live › vulnerability › CVE-2026-79877
Go to dashboardHPE Networking AOS-10 (Mobility Conductors, Controllers, Central-managed Gateways, AOS-10 APs) has an RCE flaw in the underlying operating system. An unauthenticated attacker on the same layer-2 network (adjacent) can run arbitrary commands as a privileged user, which compromises the whole device. CVSS 8.8 (AV:A/AC:L/PR:N/UI:N). Found by HPE internal research. HPE is not aware of public discussion, exploit code or exploitation. One of 72 CVEs in bulletin HPESBNW05162; it does not affect AOS-8.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| HPE Networking AOS-10 | vendor | >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
show version on each AOS-10 controller, gateway and AP10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13 (NVD also lists 10.6.0.0 and 10.3.0.0 as lower bounds)10.7.2.7 or 10.4.1.14 (or later in your train); download from networkingsupport.hpe.comEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-79877")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.