{"id":"CVE-2026-79880","kind":"vulnerability","aliases":["CVE-2026-79880"],"related":[],"title":"AOS-8 CLI flaw lets a privileged remote user run OS commands","description":"A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","summary":"CVE-2026-79880 is in HPE bulletin HPESBNW05162. It is an authenticated, high-privilege SSRF in the AOS-8 CLI that can lead to command execution on the underlying OS. It is one of 72 CVEs fixed in AOS-8 and AOS-10. HPE knows of no public exploit code or in-the-wild exploitation.","severity":"high","cvss":8.7,"epss":0.0027,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Aruba Networking AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"<= 8.13.3.0 (8.13 branch), <= 8.10.0.23 (8.10 branch)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","network-appliance","rce","ssrf","wireless-controller"],"not_affected_if":["aos-10-only","auth-required"],"how_to_check":"Run 'show version' on each Mobility Conductor, controller or Instant AP. You are affected if AOS-8 is 8.13.3.0 or earlier in the 8.13 branch, or 8.10.0.23 or earlier in the 8.10 branch. Releases past end of maintenance are presumed affected. Also check whether the CLI and web management interfaces are reachable from untrusted networks.","fix":"Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, or any later release that contains the fix. Until then, restrict CLI and web management to a dedicated L2 segment/VLAN, apply L3+ firewall policy, and enable accounting controls.","status":"open","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:35:11+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T22:35:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8 CLI flaw lets a privileged remote user run OS commands","impact":"high","summary":"A flaw in the command line interface of AOS-8 lets an authenticated remote attacker with high privileges make server-side requests. The sources say successful exploitation can also execute arbitrary commands on the underlying operating system.","category":"infrastructure","who_cares":["aos-8","aruba","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges runs arbitrary commands on the appliance OS","analyst_note":"Find the vendor advisory and the fixed AOS-8 versions; the NVD entry gives no affected version range or patch.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000455,"input_tokens":2899,"output_tokens":331,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed AOS-8 versions; the NVD entry gives no affected version range or patch.","search":"'-10':80B '-2026':14A,17A,38B '-79880':15A,18A,39B '-8':2A,23A,25B,56B,77B,103C '72':72B 'allow':105C,126C 'ao':1A,24B,55B,76B,79B,102C 'aos':22A 'applianc':31B 'arbitrari':131C 'aruba':20A,26B 'attack':109C,122C,128C 'authent':48B,107C 'bulletin':43B 'cli':3A,57B 'code':87B 'command':12A,62B,98C,132C 'conduct':114C 'control':36B 'could':104C,125C 'cve':13A,16A,37B 'cves':73B 'execut':63B,130C 'exploit':86B,93B,124C 'fix':74B 'flaw':4A 'forgeri':120C 'high':50B,111C 'high-privileg':49B 'hpe':19A,27B,42B,81B 'hpesbnw05162':44B 'in-the-wild':89B 'infrastructur':28B 'interfac':100C 'know':82B 'lead':60B 'let':5A 'line':99C 'network':30B 'network-appli':29B 'networking':21A 'one':70B 'oper':136C 'os':11A,67B 'privileg':7A,51B,112C 'public':85B 'rce':32B 'remot':8A,108C 'request':119C 'run':10A 'server':117C 'server-sid':116C 'side':118C 'ssrf':33B,52B,121C 'success':123C 'system':137C 'under':66B,135C 'user':9A 'vulner':95C 'wild':92B 'wireless':35B 'wireless-control':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79880","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79880:488","url":null,"severity":null,"published_at":"2026-10-23T23:38:47+00:00","modified_at":"2026-10-23T23:38:47+00:00","first_seen_at":"2026-10-23T23:38:47+00:00","fetched_at":"2026-10-23T23:38:47+00:00","note":"Part of HPE bulletin HPESBNW05162 (2026-10-22). Versions and fix come from CyberPress and BleepingComputer; the HPE page text was not readable. HPE says no public PoC and no exploitation known. Per-CVE detail is unconfirmed beyond the table row (AOS-8 CLI, authenticated high-privilege SSRF leading to command execution)."},{"source":"epss","external_id":"CVE-2026-79880","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79880","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1279,"url":"https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/","title":"Critical HPE Aruba AOS-8 Vulnerability (cyberpress)","kind":"blog","source":"analyst","text":"Secondary. Fixed: AOS-8 8.13.3.1 or 8.10.0.24. Mitigation: restrict CLI/web mgmt to dedicated L2 VLAN, L3+ firewall. No known public discussion or exploit as of bulletin.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}