{"id":"CVE-2026-95706","kind":"vulnerability","aliases":["CVE-2026-95706"],"related":[],"title":"Aruba AOS-8: authenticated command injection lets attacker run OS commands","description":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","summary":"Aruba AOS-8 has command injection flaws in an affected interface. An authenticated remote attacker with high privileges can run commands on the underlying operating system with the privileges of the impacted mechanism.","severity":"high","cvss":7.2,"epss":0.00342,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aos-8","aruba","infrastructure","network-appliance"],"not_affected_if":["auth-required"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-22T19:18:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:27:48+00:00","updated_at":"2026-10-25T03:27:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T03:27:48Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Aruba AOS-8: authenticated command injection lets attacker run OS commands","impact":"high","summary":"Aruba AOS-8 has command injection flaws in an affected interface. An authenticated remote attacker with high privileges can run commands on the underlying operating system with the privileges of the impacted mechanism.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","aruba","network-appliance"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker runs OS commands on the appliance with high privileges.","analyst_note":"Find the vendor advisory and the affected AOS-8 versions and fixed builds; the NVD entry gives no version list.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"AOS-8 controllers exposing the affected interface to remote users with high-privilege accounts. The sources do not name the exact interface or affected versions, so unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000534,"input_tokens":3348,"output_tokens":399,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-8':3A,19B,27B,67C '-95706':14A,17A 'affect':34B,63C 'allow':69C,84C 'ao':2A,18B,26B,66C 'applianc':24B 'aruba':1A,20B,25B 'attack':8A,39B,73C,86C 'authent':4A,37B,71C 'command':5A,11A,29B,45B,58C,79C,89C 'could':68C,83C 'cve':12A,15A 'execut':88C 'exploit':82C 'flaw':31B 'high':41B,75C 'impact':56B,95C 'infrastructur':21B 'inject':6A,30B,59C,80C 'interfac':35B,64C 'let':7A 'mechan':57B,96C 'network':23B 'network-appli':22B 'oper':49B,100C 'os':10A 'perform':78C 'privileg':42B,53B,76C,92C 'remot':38B,72C 'run':9A,44B 'success':81C 'system':50B,101C 'under':48B,99C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"AOS-8 controllers exposing the affected interface to remote users with high-privilege accounts. The sources do not name the exact interface or affected versions, so unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95706","severity":null,"published_at":"2026-10-22T19:18:06+00:00","modified_at":"2026-10-23T20:17:29+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-95706","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95706","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}