CVE-2026-79853 PUBLISHED

Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10

Assigner: hpe
Reserved: 25.08.2026 Published: 22.10.2026 Updated: 23.10.2026

Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Hewlett Packard Enterprise (HPE)
Product ArubaOS (AOS)
Versions Default: affected
  • affected from 10.8.0.0 to 10.8.1.1 (incl.)
  • affected from 10.7.0.0 to 10.7.2.6 (incl.)
  • affected from 10.4.0.0 to 10.4.1.13 (incl.)

Credits

  • This vulnerability was reported by moonv to the HPE Networking Bug Bounty program. reporter

References