---
id: "CVE-2026-79956"
kind: "vulnerability"
aliases: ["CVE-2026-79956"]
title: "AOS-8 web interface: authenticated users can run OS commands remotely"
severity: "high"
cvss: 7.2
epss: 0.00342
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": "8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aos-8", "aruba", "command-injection", "hpe", "infrastructure", "network-appliance"]
not_affected_if: ["management-interface-restricted"]
published_at: "2026-10-22T19:18:02+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:30:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79956", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79956", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:30:14+00:00"}]
---

# AOS-8 web interface: authenticated users can run OS commands remotely

Command injection (CWE-77) in the CLI command handling of the AOS-8 web interface. An authenticated remote attacker with high privileges can run arbitrary OS commands on the appliance. CVSS 7.2. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-8 affected 8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

Run 'show version' on the Mobility Conductor or Controller. You are exposed if AOS-8 is on 8.13.3.0 or earlier (8.13 branch) or 8.10.0.23 or earlier (8.10 branch), per a secondary source. Confirm against HPESBNW05162.

## Fix

Per a secondary source (cyberpress), upgrade to AOS-8 8.13.3.1 or 8.10.0.24, or a later release. Confirm against HPESBNW05162. Also restrict CLI and web management interfaces to a dedicated layer 2 segment/VLAN or firewall them, as HPE recommends.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79956
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79956
- 2026-10-25T03:30:14+00:00 analyst — Vendor bulletin HPESBNW05162 (2026-10-22) covers this CVE, but its page returned only the title to me, so nothing is marked verified. Versions come from the cyberpress rewrite. BleepingComputer quotes HPE as seeing no public PoC or exploitation, though that quote is about the 8 max-severity CVEs, not this one. CISA SSVC: exploitation none. CVSS 7.2, PR:H, CWE-77.

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
- [mentions] Critical HPE Aruba AOS-8 Vulnerability (cyberpress) https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/

## From the sources

A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_