{"id":"CVE-2026-95704","kind":"vulnerability","aliases":["CVE-2026-95704"],"related":[],"title":"Wireless network management web interface flaw allows remote code execution","description":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.","summary":"Authenticated (admin-level) remote code execution in the web-based management interface of HPE Networking (Aruba) AOS-8 and AOS-10 wireless OS, patched in bulletin HPESBNW05162. CVSS 7.2, PR:H. HPE reports no public exploit code. The same bulletin fixes several unauthenticated 10.0 flaws, so patch the whole set.","severity":"high","cvss":7.2,"epss":0.00342,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":"<= 10.8.1.1 (10.8.x); <= 10.7.2.6 (10.7.x); <= 10.4.1.13 (10.4.x)","ecosystem":"vendor"},{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"<= 8.13.3.0 (8.13.x); <= 8.10.0.23 (8.10.x)","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-10","aos-8","aruba","hpe","infrastructure","network-management","rce","web-ui","wireless"],"not_affected_if":["no-hpe-aos-wireless","no-wireless-management-system","patched-version"],"how_to_check":"Check the running AOS version on each Mobility Conductor, Controller, Gateway, AOS-10 AP and AOS-8 Instant AP. You are affected at or below: 10.8.1.1, 10.7.2.6, 10.4.1.13, 8.13.3.0, 8.10.0.23. Also check whether the CLI/web management interface is reachable from non-management networks.","fix":"Upgrade to AOS 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 or later (download from networkingsupport.hpe.com). Until then, restrict the CLI and web management interfaces to a dedicated layer-2 segment/VLAN and/or firewall policy, as HPE advises. End-of-maintenance releases are presumed affected; move to a supported release.","status":"open","published_at":"2026-10-22T19:18:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:27:50+00:00","updated_at":"2026-10-25T03:29:14+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:27:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Wireless network management web interface flaw allows remote code execution","impact":"high","summary":"A flaw in the web management interface of wireless network management systems lets an authenticated remote attacker run arbitrary commands on the underlying operating system. Successful exploitation could compromise system integrity and data security.","category":"infrastructure","nicknames":[],"who_cares":["wireless","network-management","web-ui"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands on the management server","analyst_note":"Identify the affected vendor and product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-95704, then find version ranges and the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-wireless-management-system"],"who_is_affected":"Teams that run wireless network management systems with a web-based management interface reachable by administrators. The sources do not name the affected vendor, product or versions, so exposure cannot be confirmed from this text.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000544,"input_tokens":3335,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected vendor and product from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-95704, then find version ranges and the vendor advisory.","search":"'-10':18A,22B,58B '-2026':12A,15A '-8':20A,24B,55B '-95704':13A,16A '10.0':81B '7.2':66B 'admin':38B 'admin-level':37B 'allow':7A,103C 'ao':21B,23B,54B,57B 'aos':17A,19A 'arbitrari':120C 'aruba':25B,53B 'attack':107C,117C 'authent':36B,105C 'base':47B,94C 'bulletin':63B,77B 'code':9A,41B,74B,111C 'command':121C 'compromis':128C 'could':102C,114C 'cve':11A,14A 'cvss':65B 'data':132C 'enabl':115C 'execut':10A,42B,109C,119C 'exploit':73B,113C 'fix':78B 'flaw':6A,82B 'h':68B 'hpe':26B,51B,69B 'hpesbnw05162':64B 'infrastructur':27B 'integr':130C 'interfac':5A,49B,96C 'level':39B 'manag':3A,30B,48B,95C,100C 'network':2A,29B,52B,99C 'network-manag':28B 'oper':125C 'os':60B 'patch':61B,84B 'potenti':127C 'pr':67B 'public':72B 'rce':31B 'remot':8A,40B,106C,110C 'report':70B 'secur':133C 'set':87B 'sever':79B 'success':112C 'system':101C,126C,129C 'ui':34B 'unauthent':80B 'under':124C 'vulner':89C 'web':4A,33B,46B,93C 'web-bas':45B,92C 'web-ui':32B 'whole':86B 'wireless':1A,35B,59B,98C","nicknames":[],"mitigations":[],"who_affected":"Teams running HPE Networking / Aruba wireless: Mobility Conductors, Mobility Controllers, Gateways managed by HPE Networking Central, AOS-10 APs and AOS-8 Instant APs on the versions listed. The attacker needs admin-level credentials (PR:H) and access to the web management interface. Networks where management is isolated and credentials are tightly held are lower risk, but the same bulletin has unauthenticated critical flaws, so everyone on these versions should patch.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:29:14Z","by":"analyst","run_id":728},"products":{"at":"2026-10-25T03:29:14Z","by":"analyst","run_id":728},"workarounds":{"at":"2026-10-25T03:29:14Z","by":"analyst","run_id":728}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95704","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95704","severity":null,"published_at":"2026-10-22T19:18:06+00:00","modified_at":"2026-10-23T20:17:29+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-95704","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95704","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95704:728","url":null,"severity":null,"published_at":"2026-10-25T03:29:14+00:00","modified_at":"2026-10-25T03:29:14+00:00","first_seen_at":"2026-10-25T03:29:14+00:00","fetched_at":"2026-10-25T03:29:14+00:00","note":"HPE AOS-8/AOS-10 (Aruba) bug, bulletin HPESBNW05162 (22 Oct 2026); versions/fix/workaround read in HPE's own CSAF text. The per-CVE entry for 95704 was cut off in the fetch, so the bulletin-wide ranges are used; they match the CVE record's ranges. No exploitation or PoC per HPE; CISA SSVC says none."}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3192,"url":"https://www.cve.org/CVERecord?id=CVE-2026-95704","title":"CVE Record: CVE-2026-95704 (HPE CNA)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}