{"id":"CVE-2026-79881","kind":"vulnerability","aliases":["CVE-2026-79881"],"related":[],"title":"AOS-8 operating system auth bypass lets remote attacker run code as root","description":"An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","summary":"An authentication bypass in the underlying operating system of AOS-8 lets an unauthenticated remote attacker get past existing authentication controls. Successful exploitation can run arbitrary code as a privileged user, giving full control of the device.","severity":"high","cvss":8.3,"epss":0.00196,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.10.0.24","8.13.3.1"],"affected":">= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","auth-bypass","hpe","infrastructure","network-appliance","rce","unauthenticated"],"not_affected_if":["aos-10-only","management-interface-not-reachable"],"how_to_check":"Run 'show version' on each Mobility Conductor/Controller/Gateway; affected if on 8.10.0.0-8.10.0.23 or 8.12.0.0-8.13.3.0 (or an older unsupported release). Check whether CLI/web management is reachable from untrusted networks.","fix":"Upgrade AOS-8 to 8.13.3.1 (8.12/8.13 branch) or 8.10.0.24 (8.10 branch) or later, per HPESBNW05162 as reported by secondary sources; confirm on the HPE page. Interim: restrict CLI and web management to a dedicated L2 segment/VLAN and L3+ firewall policy, enable accounting.","status":"open","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:02:06+00:00","updated_at":"2026-10-25T03:19:36+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:02:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8 operating system auth bypass lets remote attacker run code as root","impact":"high","summary":"An authentication bypass in the underlying operating system of AOS-8 lets an unauthenticated remote attacker get past existing authentication controls. Successful exploitation can run arbitrary code as a privileged user, giving full control of the device.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","network-appliance"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code as privileged user on the appliance","analyst_note":"Find the vendor advisory for CVE-2026-79881 to get affected AOS-8 versions, fixed releases and any workaround; sources here give only the NVD description.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000515,"input_tokens":3359,"output_tokens":358,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-79881 to get affected AOS-8 versions, fixed releases and any workaround; sources here give only the NVD description.","search":"'-2026':15A,18A '-79881':16A,19A '-8':2A,21A,23B,45B,83C 'allow':85C,98C 'ao':1A,22B,44B,82C 'aos':20A 'applianc':32B 'arbitrari':60B,103C 'aruba':24B 'attack':9A,50B,89C,100C 'auth':5A,26B 'auth-bypass':25B 'authent':36B,54B,73C,93C 'bypass':6A,27B,37B,74C 'circumv':91C 'code':11A,61B,104C 'complet':116C 'compromis':118C 'control':55B,68B,94C 'could':84C,97C 'cve':14A,17A 'devic':71B 'execut':102C 'exist':53B,92C 'exploit':57B,96C 'full':67B 'get':51B 'give':66B 'hpe':28B 'infrastructur':29B 'lead':114C 'let':7A,46B 'network':31B 'network-appli':30B 'oper':3A,41B,79C,112C 'past':52B 'privileg':64B,107C 'rce':33B 'remot':8A,49B,88C 'root':13A 'run':10A,59B 'success':56B,95C 'system':4A,42B,80C,113C,117C 'unauthent':34B,48B,87C 'under':40B,78C,111C 'user':65B,108C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79881","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79881","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79881","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79881:693","url":null,"severity":null,"published_at":"2026-10-25T03:19:36+00:00","modified_at":"2026-10-25T03:19:36+00:00","first_seen_at":"2026-10-25T03:19:36+00:00","fetched_at":"2026-10-25T03:19:36+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026) page is JS-only/unreadable; affected ranges from CVE.org CNA record (HPE), fixes 8.13.3.1/8.10.0.24 from Cyberpress (secondary). No exploitation or PoC per HPE. Nothing marked verified. Note CVE.org lists 8.12.0.0-8.13.3.0 (OPSWAT says 8.13.0.0+). Settle by reading the bulletin entry."}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3120,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79881","title":"CVE Record CVE-2026-79881 (HPE CNA)","kind":"advisory","source":"analyst","text":"CVSS 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Affected 8.12.0.0 through 8.13.3.0; 8.10.0.0 through 8.10.0.23. Reference: HPESBNW05162. Reporter: HPE internal research.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1279,"url":"https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/","title":"Critical HPE Aruba AOS-8 Vulnerability (cyberpress)","kind":"blog","source":"analyst","text":"Secondary. Fixed: AOS-8 8.13.3.1 or 8.10.0.24. Mitigation: restrict CLI/web mgmt to dedicated L2 VLAN, L3+ firewall. No known public discussion or exploit as of bulletin.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}