HPE ArubaOS 10: Unauthenticated information disclosure leads to remote code execution
Summary
HPE's ArubaOS 10 (AOS-10) contains a critical flaw in an affected interface that lets an unauthenticated remote attacker obtain sensitive information from the device. According to HPE, successful exploitation can allow arbitrary command execution on the underlying operating system. The CVSS score is 9.8 and no privileges or user interaction are required, so affected AOS-10 gateways, controllers and access points that are reachable over the network are at risk.
Affected
- AOS-10 10.8.0.0 to 10.8.1.1
- AOS-10 10.7.0.0 to 10.7.2.6
- AOS-10 10.4.0.0 to 10.4.1.13
- Third-party sites also list 10.3.x and 10.6.x; unverified, check the HPE bulletin.
Fixed in
- AOS-10.8.x: 10.8.1.2 or later
- AOS-10.7.x: 10.7.2.7 or later
- AOS-10.4.x: 10.4.1.14 or later
- Fixed versions for 10.3.x and 10.6.x: Unknown, check the HPE bulletin version table.
Workaround
Unknown.
Exploitation
- HPE is not aware of any public discussion or exploit code targeting the listed vulnerabilities as of the advisory date.
- Third-party trackers report no known exploitation and no CISA KEV listing as of 24 October 2026; recheck the CISA KEV catalogue.
- No public proof of concept is known.
Our recommendation
- Inventory all AOS-10 gateways, controllers and access points, including Central-managed devices, and record their versions.
- Upgrade affected devices to the fixed release, after checking the HPE bulletin version table.
- Restrict remote reachability of management and affected interfaces until patched; verify the affected interface in the HPE advisory.
- Monitor the HPE advisory, NVD and the CISA KEV catalogue for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- Belgian CCB advisory on HPE Networking AOS ccb.belgium.be
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- VulDB: CVE-2026-79853 vuldb.com
- Rescana: HPE Aruba AOS October 2026 advisory www.rescana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:57.
Original description (NVD)
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.