{"id":"CVE-2026-79956","kind":"vulnerability","aliases":["CVE-2026-79956"],"related":[],"title":"AOS-8 web interface: authenticated users can run OS commands remotely","description":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.","summary":"Command injection (CWE-77) in the CLI command handling of the AOS-8 web interface. An authenticated remote attacker with high privileges can run arbitrary OS commands on the appliance. CVSS 7.2. No known exploitation or public PoC.","severity":"high","cvss":7.2,"epss":0.00342,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","command-injection","hpe","infrastructure","network-appliance"],"not_affected_if":["management-interface-restricted"],"how_to_check":"Run 'show version' on the Mobility Conductor or Controller. You are exposed if AOS-8 is on 8.13.3.0 or earlier (8.13 branch) or 8.10.0.23 or earlier (8.10 branch), per a secondary source. Confirm against HPESBNW05162.","fix":"Per a secondary source (cyberpress), upgrade to AOS-8 8.13.3.1 or 8.10.0.24, or a later release. Confirm against HPESBNW05162. Also restrict CLI and web management interfaces to a dedicated layer 2 segment/VLAN or firewall them, as HPE recommends.","status":"open","published_at":"2026-10-22T19:18:02+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:27:51+00:00","updated_at":"2026-10-25T03:30:14+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:27:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8 web interface: authenticated users can run OS commands remotely","impact":"high","summary":"The CLI command handling in the AOS-8 web interface lets an authenticated remote attacker run arbitrary commands on the underlying operating system. A successful attack could lead to full compromise of the appliance.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","network-appliance","aruba"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs OS commands on the appliance after logging in","analyst_note":"Find the vendor advisory and the affected and fixed AOS-8 versions; NVD entry has no product list here.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running the AOS-8 web management interface on Aruba (HPE) controllers or gateways. The sources do not list affected versions or whether the interface must be exposed to the network, so the exposure rules are unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000534,"input_tokens":3353,"output_tokens":398,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected and fixed AOS-8 versions; NVD entry has no product list here.","search":"'-2026':13A,16A '-77':34B '-79956':14A,17A '-8':2A,19A,21B,43B,79C '7.2':62B 'allow':83C,100C 'ao':1A,20B,42B,78C 'aos':18A 'applianc':30B,60B 'arbitrari':55B,90C 'aruba':22B 'attack':49B,87C,102C 'authent':5A,47B,85C 'cli':37B,73C 'command':10A,24B,31B,38B,57B,74C,91C,106C 'command-inject':23B 'compromis':114C 'could':82C,99C 'cve':12A,15A 'cvss':61B 'cwe':33B 'execut':89C 'exploit':65B,98C 'handl':39B,75C 'high':51B 'hpe':26B 'infrastructur':27B 'inject':25B,32B 'interfac':4A,45B,81C 'known':64B 'lead':111C 'network':29B 'network-appli':28B 'oper':95C 'os':9A,56B 'poc':68B 'potenti':110C 'privileg':52B 'public':67B 'remot':11A,48B,86C 'run':8A,54B,104C 'success':97C 'system':96C,109C,113C 'unauthor':105C 'under':94C 'user':6A 'vulner':70C 'web':3A,44B,80C","nicknames":[],"mitigations":[],"who_affected":"Organizations running the AOS-8 web management interface on Aruba (HPE) controllers or gateways. The sources do not list affected versions or whether the interface must be exposed to the network, so the exposure rules are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79956","severity":null,"published_at":"2026-10-22T19:18:02+00:00","modified_at":"2026-10-23T20:17:27+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79956","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79956","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79956:729","url":null,"severity":null,"published_at":"2026-10-25T03:30:14+00:00","modified_at":"2026-10-25T03:30:14+00:00","first_seen_at":"2026-10-25T03:30:14+00:00","fetched_at":"2026-10-25T03:30:14+00:00","note":"Vendor bulletin HPESBNW05162 (2026-10-22) covers this CVE, but its page returned only the title to me, so nothing is marked verified. Versions come from the cyberpress rewrite. BleepingComputer quotes HPE as seeing no public PoC or exploitation, though that quote is about the 8 max-severity CVEs, not this one. CISA SSVC: exploitation none. CVSS 7.2, PR:H, CWE-77."}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1279,"url":"https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/","title":"Critical HPE Aruba AOS-8 Vulnerability (cyberpress)","kind":"blog","source":"analyst","text":"Secondary. Fixed: AOS-8 8.13.3.1 or 8.10.0.24. Mitigation: restrict CLI/web mgmt to dedicated L2 VLAN, L3+ firewall. No known public discussion or exploit as of bulletin.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}