{"id":"CVE-2026-95708","kind":"vulnerability","aliases":["CVE-2026-95708"],"related":[],"title":"Aruba AOS-10: command injection lets a privileged remote user run OS commands","description":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","summary":"Authenticated file write leading to command injection in an AOS-10 interface lets a remote attacker with high privileges run arbitrary commands as a privileged OS user. Patched in HPE bulletin HPESBNW05162; fixed builds not confirmed.","severity":"high","cvss":7.2,"epss":0.00367,"exploited":false,"exploited_at":null,"products":[{"name":"ArubaOS (AOS-10)","fixed":[],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-10","aruba","authenticated","hpe","infrastructure","network-gear"],"not_affected_if":["aos-8-only","management-interface-restricted"],"how_to_check":"On each AOS-10 gateway or AP, run 'show version'. Exposed if it runs 10.4.x up to 10.4.1.13, 10.7.x up to 10.7.2.6, or 10.8.x up to 10.8.1.1. Also check whether CLI and web management interfaces are reachable from untrusted networks.","fix":"Upgrade to the fixed AOS-10 release listed in HPE bulletin HPESBNW05162. Fixed version unknown: the HPE page could not be read and no other source names it. Meanwhile restrict CLI and web management interfaces to a dedicated L2 VLAN and/or L3+ firewall policy (HPE guidance as quoted by BleepingComputer).","status":"open","published_at":"2026-10-22T19:18:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:27:47+00:00","updated_at":"2026-10-25T03:29:14+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-10-25T03:27:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-10: command injection lets a privileged remote user run OS commands","impact":"high","summary":"Command injection flaws in an AOS-10 management interface let an authenticated remote attacker with high privileges run arbitrary commands. Successful exploitation runs those commands as a privileged user on the underlying operating system.","category":"infrastructure","nicknames":[],"who_cares":["aos-10","aruba","network-gear"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as a privileged OS user","analyst_note":"Sources give no affected AOS-10 versions, fixed release or vendor advisory; check the NVD entry references for the Aruba advisory and patched build.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00051,"input_tokens":3348,"output_tokens":351,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected AOS-10 versions, fixed release or vendor advisory; check the NVD entry references for the Aruba advisory and patched build.","search":"'-10':3A,22A,24B,42B,78C '-2026':15A,18A '-95708':16A,19A 'affect':74C 'allow':81C,96C 'ao':2A,23B,41B,77C 'aos':21A 'arbitrari':52B,101C 'aruba':1A,25B 'arubaos':20A 'attack':47B,85C,98C 'authent':26B,32B,83C 'build':65B 'bulletin':62B 'command':4A,13A,37B,53B,68C,91C,102C 'confirm':67B 'could':80C,95C 'cve':14A,17A 'execut':100C 'exist':71C 'exploit':94C 'file':33B 'fix':64B 'gear':31B 'high':49B,87C 'hpe':27B,61B 'hpesbnw05162':63B 'infrastructur':28B 'inject':5A,38B,69C,92C 'interfac':43B,75C 'lead':35B 'let':6A,44B 'network':30B 'network-gear':29B 'oper':110C 'os':12A,57B 'patch':59B 'perform':90C 'privileg':8A,50B,56B,88C,105C 'remot':9A,46B,84C 'run':11A,51B 'success':93C 'system':111C 'under':109C 'user':10A,58B,106C 'vulner':70C 'write':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95708","severity":null,"published_at":"2026-10-22T19:18:06+00:00","modified_at":"2026-10-23T20:17:30+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-95708","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95708","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95708:726","url":null,"severity":null,"published_at":"2026-10-25T03:29:14+00:00","modified_at":"2026-10-25T03:29:14+00:00","first_seen_at":"2026-10-25T03:29:14+00:00","fetched_at":"2026-10-25T03:29:14+00:00","note":"Part of HPE bulletin HPESBNW05162 (Oct 22); HPE page is JS-only so nothing verified. Affected ranges from CNA record via SecHOT mirror; fixed AOS-10 versions not stated in any source read. No exploitation or PoC per HPE (via BleepingComputer)."}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3194,"url":"https://www.sechot.net/cve/CVE-2026-95708","title":"SecHOT: CVE-2026-95708","kind":"other","source":"analyst","text":"Mirror of CNA (HPE) record. Affected: AOS-10 10.8.0.0-10.8.1.1; 10.7.0.0-10.7.2.6; 10.4.0.0-10.4.1.13. Fixed: not stated. CWE-77. CVSS 7.2 AV:N/PR:H. Title: Authenticated File Write leads to Command Injection. No known exploitation, no public PoC.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}