{"id":"CVE-2026-79877","kind":"vulnerability","aliases":["CVE-2026-79877"],"related":[],"title":"Aruba AOS-10: unauthenticated adjacent attacker runs commands as root","description":"A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.","summary":"HPE Networking AOS-10 (Mobility Conductors, Controllers, Central-managed Gateways, AOS-10 APs) has an RCE flaw in the underlying operating system. An unauthenticated attacker on the same layer-2 network (adjacent) can run arbitrary commands as a privileged user, which compromises the whole device. CVSS 8.8 (AV:A/AC:L/PR:N/UI:N). Found by HPE internal research. HPE is not aware of public discussion, exploit code or exploitation. One of 72 CVEs in bulletin HPESBNW05162; it does not affect AOS-8.","severity":"high","cvss":8.8,"epss":0.00294,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adjacent","aos-10","aruba","hpe","infrastructure","network-gear","rce","unauthenticated","wireless"],"not_affected_if":["aos-8-only","no-aos-10-devices","unknown"],"how_to_check":"Run 'show version' on each AOS-10 controller, gateway and AP. Affected: 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13 (NVD also lists 10.6.0.0 and 10.3.0.0 as lower bounds). Versions past End of Maintenance are presumed affected. Because the attacker must be adjacent, check who shares the L2 segment or VLAN with the devices (guest Wi-Fi, wired clients, management VLAN).","fix":"Upgrade to AOS-10.8.1.2, 10.7.2.7 or 10.4.1.14 (or later in your train); download from networkingsupport.hpe.com. If you cannot patch yet: restrict CLI and web management to a dedicated L2 segment/VLAN, apply L3+ firewall policy, and enable accounting. Upgrade off any end-of-maintenance release.","status":"resolved","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:44+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:31:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-10: unauthenticated adjacent attacker runs commands as root","impact":"high","summary":"A flaw in the operating system under Aruba AOS-10 lets an unauthenticated attacker on an adjacent network run arbitrary code on the device. Successful exploitation gives commands as a privileged user, which means full control of the device.","category":"infrastructure","who_cares":["aruba","aos-10","network-gear"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker runs commands as privileged user, full device compromise","analyst_note":"Source gives no affected AOS-10 versions or patched release; check the Aruba/HPE security advisory for the fixed version and the adjacent-network condition.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-aos-10-devices"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000467,"input_tokens":2934,"output_tokens":347,"severity_before":"high"},"analyst_status":"done","analyst_note":"Source gives no affected AOS-10 versions or patched release; check the Aruba/HPE security advisory for the fixed version and the adjacent-network condition.","search":"'-10':3A,20A,23B,36B,45B,127C '-2':63B '-2026':12A,15A '-79877':13A,16A '-8':114B '72':104B '8.8':80B 'a/ac':82B 'adjac':5A,21B,65B,132C 'affect':112B,140C 'allow':129C,145C 'ao':2A,22B,35B,44B,113B,126C 'aos':19A 'ap':46B 'arbitrari':68B,136C,150C 'aruba':1A,24B 'attack':6A,58B,133C,147C 'av':81B 'awar':94B 'bulletin':107B 'central':41B 'central-manag':40B 'code':99B,117C,137C 'command':8A,69B,151C 'complet':163C 'compromis':75B,165C 'conductor':38B 'control':39B 'could':128C,144C 'cve':11A,14A 'cves':105B 'cvss':79B 'devic':78B,141C 'discuss':97B 'execut':118C,135C,149C 'exploit':98B,101B,143C 'flaw':50B 'found':86B 'gateway':43B 'gear':29B 'hpe':17A,25B,33B,88B,91B 'hpesbnw05162':108B 'infrastructur':26B 'intern':89B 'l/pr':83B 'layer':62B 'lead':161C 'manag':42B 'mobil':37B 'n':85B 'n/ui':84B 'network':28B,34B,64B 'network-gear':27B 'networking':18A 'one':102B 'oper':54B,123C,159C 'privileg':72B,154C 'public':96B 'rce':30B,49B 'remot':116C 'research':90B 'root':10A 'run':7A,67B 'success':142C 'system':55B,124C,160C,164C 'unauthent':4A,31B,57B,131C 'under':53B,122C,158C 'user':73B,155C 'vulner':119C 'whole':77B 'wireless':32B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79877","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79877:491","url":null,"severity":null,"published_at":"2026-10-23T23:39:57+00:00","modified_at":"2026-10-23T23:39:57+00:00","first_seen_at":"2026-10-23T23:39:57+00:00","fetched_at":"2026-10-23T23:39:57+00:00","note":"Read HPE advisory HPESBNW05162 (CSAF text): AOS-10 only, adjacent attacker, CVSS 8.8, VULN-1084. Versions and fix confirmed; HPE knows of no PoC or exploitation. Social search skipped (day-old advisory, no CVE-specific chatter expected). NVD/CVE.org list 10.6.0.0 and 10.3.0.0 lower bounds; the advisory does not."},{"source":"epss","external_id":"CVE-2026-79877","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79877","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}