ArubaOS 8: Authentication bypass in underlying operating system
Summary
An authentication bypass in the underlying operating system of ArubaOS 8 (AOS-8) allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation can lead to arbitrary code execution as a privileged user and complete compromise of the system. According to the vendor's branch table, AOS-8.13 from 8.13.0.0 to 8.13.3.0 and AOS-8.10 from 8.10.0.0 to 8.10.0.23 are affected. The CVSS vector requires user interaction, and HPE knows of no exploitation.
Affected
- AOS-8.13.0.0 to 8.13.3.0
- AOS-8.10.0.0 to 8.10.0.23
- AOS-8.12: status unclear; sources disagree. Treat as affected until HPE confirms otherwise.
Fixed in
- AOS-8.13.3.1 or later
- AOS-8.10.0.24 or later
Verify the build numbers against HPE advisory HPESBNW05162 before rollout.
Workaround
- No workaround specific to CVE-2026-79881 has been published.
- HPE's interim guidance for the bulletin: restrict the CLI and web management interfaces to a dedicated layer 2 segment/VLAN and/or firewall policies, and enable accounting for logging.
Exploitation
- HPE knows of no exploitation in the wild and has published no IOCs.
- No public proof of concept found.
- CISA SSVC: exploitation none, not automatable.
- Not listed in CISA KEV as of 24 October 2026 according to a secondary source; verify in the live catalogue.
Our recommendation
- Inventory all AOS-8 Mobility Conductors, Controllers and Gateways and their exact versions.
- Check whether management interfaces are reachable from untrusted networks or the internet, and restrict them now.
- Schedule upgrades to 8.13.3.1 or 8.10.0.24 (or later), conductors first.
- Review logs for suspicious administrative activity and rotate credentials after patching.
- Re-check the NVD record and the HPE advisory for updates, as the NVD entry was still awaiting analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- Rescana: HPE Aruba AOS CVE-2026-79844 analysis www.rescana.com
- VulDB entry 425547 vuldb.com
- Brandefense: CVE-2026-79844 overview brandefense.io
- GBHackers: Critical HPE Aruba AOS-8 flaw gbhackers.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:20.
Original description (NVD)
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.