---
id: "CVE-2026-95706"
kind: "vulnerability"
aliases: ["CVE-2026-95706"]
title: "Aruba AOS-8: authenticated command injection lets attacker run OS commands"
severity: "high"
cvss: 7.2
epss: 0.00342
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aos-8", "aruba", "infrastructure", "network-appliance"]
not_affected_if: ["auth-required"]
published_at: "2026-10-22T19:18:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:27:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95706", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95706", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-8: authenticated command injection lets attacker run OS commands

Aruba AOS-8 has command injection flaws in an affected interface. An authenticated remote attacker with high privileges can run commands on the underlying operating system with the privileges of the impacted mechanism.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95706
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95706

## From the sources

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_