---
id: "CVE-2026-95705"
kind: "vulnerability"
aliases: ["CVE-2026-95705"]
title: "Aruba AOS-8: authenticated attacker runs commands via command injection"
severity: "high"
cvss: 7.2
epss: 0.00342
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aruba-aos-8", "infrastructure", "network-appliance"]
not_affected_if: []
published_at: "2026-10-22T19:18:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:27:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95705", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95705", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-8: authenticated attacker runs commands via command injection

Command injection flaws in an AOS-8 interface let an authenticated remote attacker with high privileges run commands. Successful exploitation runs commands on the underlying operating system with the privileges of the affected mechanism.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95705
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95705

## From the sources

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_