ArubaOS 8 (AOS-8): Authentication bypass in affected interface
Summary
Authentication bypass vulnerabilities in the affected interface of HPE ArubaOS 8 (AOS-8) allow an unauthenticated attacker on the same network segment to circumvent login controls. A successful attack can grant administrative access, change system configurations and access or manipulate sensitive data. The CNA rates the issue critical (CVSS 9.6), but the CWE classification is still disputed.
Affected
- AOS-8 8.13.0.0 to 8.13.3.0
- AOS-8 8.10.0.0 to 8.10.0.23 (default: affected)
- Secondary sources also mention the 8.12 train; verify against the HPE advisory.
Fixed in
- AOS-8 8.13.3.1 and 8.10.0.24 or later (per secondary sources; confirm in the HPE advisory)
- No fix for 8.12 is known; move to a fixed release train.
Workaround
- HPE recommends restricting access to the AOS management interfaces as an interim measure.
- Detailed workaround steps: Unknown.
Exploitation
- HPE knows of no exploitation and no public exploit code.
- Third-party reports state the CVE is not in CISA's KEV catalogue (not verified).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all AOS-8 controllers and conductors and record the exact versions.
- Upgrade to 8.13.3.1 or 8.10.0.24 or later, and plan a migration off the 8.12 train.
- Restrict management access to a dedicated admin VLAN and block it from the internet and user networks.
- Review the full HPE bulletin, which lists 72 fixes, including other AOS-8 issues rated higher.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB entry CVE-2026-79868 vuldb.com
- VulDB vulnerability 425546 vuldb.com
- Strix CVE record CVE-2026-79868 www.strix.ai
- The Layman Security: HPE Aruba AOS critical flaws thelaymansecurity.com
- Safeguard: 72 AOS-8 and AOS-10 vulnerabilities safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:11.
Original description (NVD)
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.