HPE AOS-10: Unauthenticated information disclosure in command line interface
Summary
A sensitive information disclosure vulnerability in the command line interface (CLI) of HPE ArubaOS 10 (AOS-10) wireless controllers, gateways and access points allows an unauthenticated remote attacker to access sensitive information. The attacker could use the retrieved data to gain further access to network services supported by AOS-10. The official CVE record lists the vector as adjacent network (AV:A), while the HPE text says "remote", so the attack path must be confirmed with HPE. Because no authentication is required, exposure of the management interfaces is the main risk.
Affected
- AOS-10 10.8.0.0 to 10.8.1.1
- AOS-10 10.7.0.0 to 10.7.2.6
- AOS-10 10.4.0.0 to 10.4.1.13
- Other reports also cite 10.3.x and 10.6.x trains; unverified, check the HPE advisory.
Fixed in
- AOS-10 10.8.1.2 or later
- AOS-10 10.7.2.7 or later
- AOS-10 10.4.1.14 or later
- Fixed build for the 10.3.x and 10.6.x trains: Unknown.
Workaround
- Restrict access to the CLI and web-based management interfaces to a dedicated management VLAN or to firewall-restricted hosts.
- Do not expose the management interfaces to the internet.
- Apply the patch as soon as possible; restriction is a temporary measure.
Exploitation
- Not known to be exploited in the wild as of the advisory release; not listed in CISA KEV as of catalog 2026.10.23 according to secondary reports.
- No public proof of concept or exploit code known as of the release date.
- Status can change quickly.
Our recommendation
- Inventory all AOS-10 devices and their exact build version.
- Upgrade to 10.8.1.2, 10.7.2.7 or 10.4.1.14, as appropriate for each train.
- Confirm the upgrade path for 10.3.x and 10.6.x devices in HPE's advisory or with HPE support.
- Restrict CLI and web management access now, before patching.
- Verify the attack vector and fix details in HPE's advisory and monitor CISA KEV.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB CVE-2026-79871 vuldb.com
- CyberExperts: Aruba AOS wireless patches cyberexperts.com
- Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- Adyog: HPE Aruba AOS eight max severity flaws pulse.adyog.com
- GBHackers: Critical HPE Aruba AOS 8 flaw gbhackers.com
- Brandefense: CVE-2026-79844 brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:13.
Original description (NVD)
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.