Live › vulnerability › CVE-2026-79956
Go to dashboardCommand injection (CWE-77) in the CLI command handling of the AOS-8 web interface. An authenticated remote attacker with high privileges can run arbitrary OS commands on the appliance. CVSS 7.2. No known exploitation or public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running the AOS-8 web management interface on Aruba (HPE) controllers or gateways. The sources do not list affected versions or whether the interface must be exposed to the network, so the exposure rules are unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-8 | vendor | 8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
show version on the Mobility Conductor or Controller8.13.3.0 or earlier (8.13 branch) or 8.10.0.23 or earlier (8.10 branch), per a secondary source8.13.3.1 or 8.10.0.24, or a later releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-79956")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.