HPE ArubaOS AOS-10: Authentication bypass leading to remote code execution
Summary
HPE ArubaOS AOS-10, the operating system for Aruba Mobility Conductors, Controllers, Gateways and access points, contains an authentication bypass in an affected interface. An unauthenticated remote attacker could run arbitrary commands on the underlying host, but only if preconditions outside the attacker's control are met. The CVSS 3.1 score is 10.0 (critical), and HPE is not aware of public exploit code or active exploitation.
Affected
- ArubaOS 10.8.0.0 to 10.8.1.1
- ArubaOS 10.7.0.0 to 10.7.2.6
- ArubaOS 10.4.0.0 to 10.4.1.13
- Per the CVE record, versions not listed are treated as affected by default.
- Verify the exact ranges in the HPE advisory HPESBNW05162 before scoping, as third-party sources differ.
Fixed in
- ArubaOS 10.8.1.2
- ArubaOS 10.7.2.7
- ArubaOS 10.4.1.14
- AOS-8 fixes (8.13.3.1, 8.10.0.24) are reported by third parties; confirm them in the HPE advisory.
Workaround
- No vendor-confirmed workaround.
- Unverified: restricting access to the management interface is commonly recommended as an interim step.
Exploitation
- HPE is not aware of public exploit code or discussion as of the advisory date.
- Not listed in CISA's Known Exploited Vulnerabilities catalogue at the time of checking.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept or in-the-wild exploitation known as of 30 October 2026. This can change quickly.
Our recommendation
- Inventory all AOS-10 and AOS-8 devices, including gateways and access points, and record their exact versions.
- Confirm that no management interface is reachable from the internet.
- Upgrade affected devices to the fixed release for your branch within your critical patch window.
- Until patched, restrict management access to internal administration networks or a VPN.
- Review logs for unexpected administrative logins or configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- Brandefense CVE-2026-79844 overview brandefense.io
- CVEfeed CVE-2026-79844 details cvefeed.io
- Rescana CVE-2026-79844 analysis www.rescana.com
- VulDB entry 425485 vuldb.com
- Strix CVE-2026-79844 www.strix.ai
- Carthage Electronics CVE threat brief carthageelectronics.com
- Aviatrix threat research on HPE AOS flaws aviatrix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:00.
Original description (NVD)
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.