Live › vulnerability › CVE-2026-95704
Go to dashboardAuthenticated (admin-level) remote code execution in the web-based management interface of HPE Networking (Aruba) AOS-8 and AOS-10 wireless OS, patched in bulletin HPESBNW05162. CVSS 7.2, PR:H. HPE reports no public exploit code. The same bulletin fixes several unauthenticated 10.0 flaws, so patch the whole set.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running HPE Networking / Aruba wireless: Mobility Conductors, Mobility Controllers, Gateways managed by HPE Networking Central, AOS-10 APs and AOS-8 Instant APs on the versions listed. The attacker needs admin-level credentials (PR:H) and access to the web management interface. Networks where management is isolated and credentials are tightly held are lower risk, but the same bulletin has unauthenticated critical flaws, so everyone on these versions should patch.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-10 | vendor | <= 10.8.1.1 (10.8.x); <= 10.7.2.6 (10.7.x); <= 10.4.1.13 (10.4.x) | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
| AOS-8 | vendor | <= 8.13.3.0 (8.13.x); <= 8.10.0.23 (8.10.x) | 8.13.3.1, 8.10.0.24 |
10.8.1.1, 10.7.2.6, 10.4.1.13, 8.13.3.0, 8.10.0.2310.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 or later (download from networkingsupport.hpe.com)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.
This page as .md · .json · in your agent: get_signal("CVE-2026-95704")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.