HPE ArubaOS 10 (AOS-10): Unauthenticated adjacent remote code execution
Summary
A remote code execution vulnerability in the underlying operating system of HPE ArubaOS 10 (AOS-10) allows an unauthenticated attacker on the same local network or within radio range to execute arbitrary code on an affected device. Successful exploitation grants privileged command execution on the device, which can lead to full compromise and a foothold in the internal network. HPE has released fixes, and no exploitation has been reported so far.
Affected
- ArubaOS 10.4.0.0 to 10.4.1.13
- ArubaOS 10.7.0.0 to 10.7.2.6
- ArubaOS 10.8.0.0 to 10.8.1.1
- Lower bounds are unverified against the vendor advisory.
Fixed in
- Upgrade to 10.8.1.2 or later on the 10.8 branch
- Upgrade to 10.7.2.7 or later on the 10.7 branch
- Fixed release for the 10.4 branch: unverified (a secondary source names 10.4.1.14; confirm with HPE before acting)
Workaround
- No vendor-specified workaround known.
- Until patched: restrict access to AP and controller management and adjacent network segments, separate guest Wi-Fi from internal networks, and monitor controllers for unexpected activity.
Exploitation
- HPE reports no evidence of active exploitation and no public exploit code as of the advisory date.
- Not listed in CISA KEV according to one aggregator.
- Public PoC: none found.
Our recommendation
- Inventory all AOS-10 access points, gateways and controllers and note their firmware versions.
- Upgrade affected devices to the fixed releases listed in HPE advisory HPESBNW05162 and verify the exact versions there.
- Until patched, limit management access and isolate guest networks.
- Monitor for NVD and CISA updates, as the CVSS and CWE assessment is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB CVE-2026-79877 vuldb.com
- Canadian Cyber Centre advisory AV26-1079 (HPE) cirt.gy
- Strix AI CVE-2026-79877 www.strix.ai
- TechBytes: HPE patches eight max-severity RCE and auth bypass flaws techbytes.app
- pwn.watch: HPE Aruba AOS critical RCE pwn.watch
- The Backroom Tech: HPE patches 72 ArubaOS vulnerabilities thebackroomtech.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:52.
Original description (NVD)
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.