HPE ArubaOS AOS-10: Unauthenticated adjacent command injection

Summary

HPE ArubaOS AOS-10, the wireless operating system for Aruba controllers, gateways and access points, contains a command injection flaw in an affected interface. An unauthenticated attacker on the same network segment can inject commands and, according to the CNA description, run them as a privileged user on the underlying operating system. The CNA gives CVSS 9.6 and CWE-77, while VulDB lists CVSS 7.3 and CWE-94, so the HPE advisory should be checked. Exposure depends on whether management interfaces are reachable from user, guest or other untrusted segments.

Affected

• ArubaOS (AOS-10) 10.8.0.0 to 10.8.1.1
• ArubaOS (AOS-10) 10.7.0.0 to 10.7.2.6
• ArubaOS (AOS-10) 10.4.0.0 to 10.4.1.13
• Some sources also list the 10.3.x and 10.6.x branches as affected. Unknown whether they are covered by the advisory.
• Which interface is affected: Unknown.

Fixed in

• AOS-10 10.8.1.2
• AOS-10 10.7.2.7
• AOS-10 10.4.1.14
• These versions come from secondary sources and must be confirmed against HPE advisory HPESBNW05162.
• Fixed version for the 10.3.x and 10.6.x branches: Unknown.

Workaround

• Restrict the CLI and web management interfaces to a dedicated management VLAN and/or firewall policy.
• Log administrative activity.
• One source also advises blocking UDP 8211 (PAPI). This is unconfirmed for this CVE.
• These measures are interim only. Patching is the primary fix.

Exploitation

• No exploitation known to HPE at the time of research.
• Not listed in the CISA KEV catalogue (last checked 23 to 24 Oct 2026).
• No public proof-of-concept known.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Inventory all Aruba controllers, gateways and AOS-10 access points and check their versions.
• Upgrade to the fixed versions. Upgrade Conductors or controllers first, then access points, in a maintenance window, because APs reboot.
• Until patched, restrict management interfaces to a dedicated management VLAN and firewall rules, and monitor administrative logs.
• Recheck the HPE advisory and KEV status before final prioritisation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• VulDB CVE-2026-79864 vuldb.com
• VulDB entry 425500 vuldb.com
• Carthage Electronics threat brief carthageelectronics.com
• Cybaverse HPE Aruba AOS critical flaws www.cybaverse.co.uk
• Rescana HPE Aruba AOS advisory summary www.rescana.com
• Brandefense HPE Aruba AOS vulnerabilities brandefense.io
• Cyberexperts Aruba AOS wireless patches cyberexperts.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:16.