IT SBIT Services
Schneeberger
DEEN
CVE tracker

HPE ArubaOS AOS-8: Authentication bypass leading to remote code execution

CVE-2026-79867Critical 9.6

← All vulnerabilities

Summary

An authentication bypass in an interface of ArubaOS AOS-8 lets an unauthenticated attacker run arbitrary commands on the underlying host of affected Mobility Conductors and Mobility Controllers. Successful exploitation can lead to complete compromise of the device. The attacker must be on the same network segment (adjacent access), so the flaw is not directly exposed to the internet. The CVSS 9.6 score comes from the NVD/CNA record; HPE's own score was not verified.

Affected

  • AOS-8.13.0.0 to 8.13.3.0
  • AOS-8.10.0.0 to 8.10.0.23 (default: affected)
  • Unknown: whether other AOS-8 releases are affected; the per-CVE range from HPE's version table was not confirmed. Third-party aggregator Strix lists a narrower range (8.12.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23), which could not be confirmed against HPE.

Fixed in

  • AOS-8.13.x: 8.13.3.1 and above
  • AOS-8.10.x: 8.10.0.24 and above
  • AOS-8.12 branch: no fixed release; move devices to a fixed train.

Workaround

  • Keep management interfaces (CLI and web) off untrusted networks, as recommended by HPE.
  • Place management on a dedicated management VLAN or layer-2 segment, or restrict access with firewall rules.
  • Enable accounting and logging on the management interfaces.
  • These are interim measures and do not remove the vulnerability.

Exploitation

  • HPE is not aware of public exploit code or discussion for the listed vulnerabilities as of the release date.
  • CISA SSVC assessment: exploitation none, not automatable.
  • As of 25 Oct 2026, the CVE was not in CISA's KEV catalog.
  • No public proof of concept found in research; absence of evidence is not proof.
  • EPSS scores below 1% were reported for the whole advisory batch, not specifically for this CVE.

Our recommendation

  • Inventory all AOS-8 controllers and Instant access points and record their versions.
  • Restrict CLI and web management to a management VLAN or firewall rules now.
  • Plan the upgrade to 8.13.3.1 or 8.10.0.24 (or later on the same branch); move 8.12 devices to a fixed train.
  • Apply the whole HPE advisory in the same patch cycle, as it covers 72 flaws.
  • Monitor the HPE bulletin for revisions, the KEV catalog and public proof-of-concept releases.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:11.

Original description (NVD)

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed