HPE ArubaOS 8: Authentication bypass leading to remote command execution

Summary

An unauthenticated remote attacker can bypass authentication controls in an affected interface of HPE ArubaOS 8 (AOS-8) and run arbitrary commands on the underlying host. Successful exploitation allows command execution as root and complete compromise of the device. No user interaction is required, so the attack can be launched over the network. The exact affected interface is not named in the sources reviewed.

Affected

• AOS-8.13.0.0 to 8.13.3.0 (per the CVE/CSAF record)
• AOS-8.10.0.0 to 8.10.0.23 (default: affected)
• Some secondary sources list the AOS-8.13 range starting at 8.12.0.0. Treat AOS-8.12 and older builds as potentially affected until the CSAF file is checked.

Unknown: the specific affected interface.

Fixed in

• AOS-8.13: 8.13.3.1 or later
• AOS-8.10: 8.10.0.24 or later
• AOS-8 branches older than these have no fix and must be upgraded to a supported fixed release.

Workaround

• Keep management interfaces (CLI and web management) off untrusted networks.
• Restrict management access to a dedicated management VLAN or firewall policy.
• Log administrative activity.
• Upgrading is the only complete fix; these measures reduce exposure but do not remove the flaw.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• HPE stated it was not aware of public exploit code or discussion at the advisory date (22 October 2026).
• No public proof of concept or in-the-wild exploitation was found in the sources reviewed. Unknown for later dates; CISA KEV status not verified.

Our recommendation

• Inventory all AOS-8 devices, including Instant access points, and record their exact versions.
• Upgrade affected devices to 8.13.3.1, 8.10.0.24 or a later build on the same branch. Plan maintenance windows, as access points reboot during upgrades.
• Until the upgrade is complete, restrict management interfaces to a dedicated VLAN or firewall rules and confirm none are reachable from the internet.
• Review the whole HPE bulletin HPESBNW05162, including related CVE-2026-79855 and PAPI flaws on UDP 8211.
• Check the HPE bulletin and CSAF file directly for the exact affected interface and version ranges.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• BleepingComputer: HPE patches eight max-severity flaws in AOS www.bleepingcomputer.com
• CCB Belgium: Warning on critical HPE Networking AOS vulnerabilities ccb.belgium.be
• Carthage Electronics: October 2026 CVE threat brief carthageelectronics.com
• Rescana: HPE Aruba AOS critical vulnerabilities, October 2026 www.rescana.com
• CyberExperts: Aruba AOS wireless patches cyberexperts.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:57.