CVE-2026-79844 PUBLISHED

Authentication Bypass Leading to Remote Code Execution in AOS-10

Assigner: hpe
Reserved: 25.08.2026 Published: 22.10.2026 Updated: 23.10.2026

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS Score: 10

Product Status

Vendor Hewlett Packard Enterprise (HPE)
Product ArubaOS (AOS)
Versions Default: affected
  • affected from 10.8.0.0 to 10.8.1.1 (incl.)
  • affected from 10.7.0.0 to 10.7.2.6 (incl.)
  • affected from 10.4.0.0 to 10.4.1.13 (incl.)

Credits

  • Internal security research (HPE Networking). reporter

References