---
id: "CVE-2026-79877"
kind: "vulnerability"
aliases: ["CVE-2026-79877"]
title: "Aruba AOS-10: unauthenticated adjacent attacker runs commands as root"
severity: "high"
cvss: 8.8
epss: 0.00294
exploited: false
status: "resolved"
category: "infrastructure"
products: [{"name": "HPE Networking AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adjacent", "aos-10", "aruba", "hpe", "infrastructure", "network-gear", "rce", "unauthenticated", "wireless"]
not_affected_if: ["aos-8-only", "no-aos-10-devices", "unknown"]
published_at: "2026-10-22T19:18:00+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79877", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:39:57+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79877", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-10: unauthenticated adjacent attacker runs commands as root

HPE Networking AOS-10 (Mobility Conductors, Controllers, Central-managed Gateways, AOS-10 APs) has an RCE flaw in the underlying operating system. An unauthenticated attacker on the same layer-2 network (adjacent) can run arbitrary commands as a privileged user, which compromises the whole device. CVSS 8.8 (AV:A/AC:L/PR:N/UI:N). Found by HPE internal research. HPE is not aware of public discussion, exploit code or exploitation. One of 72 CVEs in bulletin HPESBNW05162; it does not affect AOS-8.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking AOS-10 affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Run 'show version' on each AOS-10 controller, gateway and AP. Affected: 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13 (NVD also lists 10.6.0.0 and 10.3.0.0 as lower bounds). Versions past End of Maintenance are presumed affected. Because the attacker must be adjacent, check who shares the L2 segment or VLAN with the devices (guest Wi-Fi, wired clients, management VLAN).

## Fix

Upgrade to AOS-10.8.1.2, 10.7.2.7 or 10.4.1.14 (or later in your train); download from networkingsupport.hpe.com. If you cannot patch yet: restrict CLI and web management to a dedicated L2 segment/VLAN, apply L3+ firewall policy, and enable accounting. Upgrade off any end-of-maintenance release.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79877
- 2026-10-23T23:39:57+00:00 analyst — Read HPE advisory HPESBNW05162 (CSAF text): AOS-10 only, adjacent attacker, CVSS 8.8, VULN-1084. Versions and fix confirmed; HPE knows of no PoC or exploitation. Social search skipped (day-old advisory, no CVE-specific chatter expected). NVD/CVE.org list 10.6.0.0 and 10.3.0.0 lower bounds; the advisory does not.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79877

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [discussion] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_