HPE ArubaOS AOS-10: Authentication bypass in API

Summary

An authentication bypass in the API of HPE ArubaOS AOS-10 allows an unauthenticated attacker on the adjacent network to circumvent existing authentication controls. A successful attack could grant administrative access, allow modification of system configurations, and enable access to or manipulation of sensitive data. The CVSS 3.1 base score is 9.3 (Critical), and the attack requires only adjacent network access, such as guest Wi-Fi or a user VLAN.

Affected

Per the CVE record (HPE as CNA): AOS-10 10.8.0.0 to 10.8.1.1; 10.7.0.0 to 10.7.2.6; 10.4.0.0 to 10.4.1.13 (default: affected).

• Sources conflict on the exact ranges (some list AOS-10.6 and AOS-10.3 instead, and one lists AOS-10.5 as presumed affected). The range for this CVE is unverified; check the HPE bulletin table.

Fixed in

Fixed releases reported by third parties, not yet verified on the HPE page:

• AOS-10 10.8.1.2
• AOS-10 10.7.2.7
• AOS-10 10.4.1.14

Patch status for the AOS-10.5 and AOS-10.6 trains is unclear. Do not assume they are fixed without confirming with HPE.

Workaround

HPE's interim advice for the bulletin:

• Restrict the CLI and web management interfaces to a dedicated layer-2 VLAN and/or firewall policies at layer 3 and above.
• Limit PAPI traffic (UDP 8211) to trusted devices. It is not confirmed that PAPI is the attack path for this CVE.
• Review logs for unexpected administrative logins or configuration changes.

Exploitation

• HPE reported no active exploitation or public exploit tools for the bulletin's bugs at release. This covers the bulletin as a whole.
• Not listed in CISA KEV according to third-party sites; not re-checked directly.
• EPSS is below 1% according to a third-party site.
• No public proof-of-concept found.

Our recommendation

• Inventory all AOS-10 and AOS-8 devices (controllers, gateways, access points) with exact versions.
• Restrict management interface and PAPI access now, and limit guest and user networks from reaching them.
• Confirm the affected range for CVE-2026-79874 in the HPE bulletin, especially for AOS-10.5 and AOS-10.6.
• Upgrade each branch to the fixed release from HPE.
• Review logs for unexpected administrative access or configuration changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE security bulletin HPESBNW05162 support.hpe.com
• OpenCVE: CVE-2026-79874 app.opencve.io
• Strix: CVE-2026-79874 www.strix.ai
• VulDB entry 425473 (conflicting description, treat as unreliable) vuldb.com
• Securityonline: HPE Networking AOS vulnerabilities securityonline.info
• Cyberexperts: Aruba AOS wireless patches cyberexperts.com
• Rescana: HPE Aruba AOS CVE analysis www.rescana.com
• Techbytes: HPE patches AOS flaws techbytes.app

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:53.