Live › vulnerability › CVE-2026-95708
Go to dashboardAuthenticated file write leading to command injection in an AOS-10 interface lets a remote attacker with high privileges run arbitrary commands as a privileged OS user. Patched in HPE bulletin HPESBNW05162; fixed builds not confirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| ArubaOS (AOS-10) | vendor | >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 | – |
show version10.4.1.13, 10.7.x up to 10.7.2.6, or 10.8.x up to 10.8.1.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95708")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.