Live › vulnerability › CVE-2026-95709
Go to dashboardAuthenticated command injection in an unnamed interface of HPE Networking AOS-10. A remote attacker with high privileges (admin) can run arbitrary commands as a privileged user on the device OS. CVSS 7.2. Fixed in 10.8.1.2, 10.7.2.7, 10.4.1.14. HPE reports no public exploit or discussion.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-10 | vendor | 10.8.x <= 10.8.1.1; 10.7.x <= 10.7.2.6; 10.4.x <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
show version, or the device list in HPE Networking Central)10.8.1.1, 10.7.x <= 10.7.2.6, or 10.4.x <= 10.4.1.1310.8.1.2 or later, 10.7.2.7 or later, or 10.4.1.14 or later (networkingsupport.hpe.com)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95709")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.