---
id: "CVE-2026-95708"
kind: "vulnerability"
aliases: ["CVE-2026-95708"]
title: "Aruba AOS-10: command injection lets a privileged remote user run OS commands"
severity: "high"
cvss: 7.2
epss: 0.00367
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ArubaOS (AOS-10)", "fixed": [], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aos-10", "aruba", "authenticated", "hpe", "infrastructure", "network-gear"]
not_affected_if: ["aos-8-only", "management-interface-restricted"]
published_at: "2026-10-22T19:18:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:29:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95708", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95708", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:29:14+00:00"}]
---

# Aruba AOS-10: command injection lets a privileged remote user run OS commands

Authenticated file write leading to command injection in an AOS-10 interface lets a remote attacker with high privileges run arbitrary commands as a privileged OS user. Patched in HPE bulletin HPESBNW05162; fixed builds not confirmed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ArubaOS (AOS-10) affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed ?

## How to check

On each AOS-10 gateway or AP, run 'show version'. Exposed if it runs 10.4.x up to 10.4.1.13, 10.7.x up to 10.7.2.6, or 10.8.x up to 10.8.1.1. Also check whether CLI and web management interfaces are reachable from untrusted networks.

## Fix

Upgrade to the fixed AOS-10 release listed in HPE bulletin HPESBNW05162. Fixed version unknown: the HPE page could not be read and no other source names it. Meanwhile restrict CLI and web management interfaces to a dedicated L2 VLAN and/or L3+ firewall policy (HPE guidance as quoted by BleepingComputer).

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95708
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95708
- 2026-10-25T03:29:14+00:00 analyst — Part of HPE bulletin HPESBNW05162 (Oct 22); HPE page is JS-only so nothing verified. Affected ranges from CNA record via SecHOT mirror; fixed AOS-10 versions not stated in any source read. No exploitation or PoC per HPE (via BleepingComputer).

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] SecHOT: CVE-2026-95708 https://www.sechot.net/cve/CVE-2026-95708
- [mitigation] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_