HPE ArubaOS 8: Authentication bypass leads to information disclosure
Summary
A flaw in the web-based management interface of HPE ArubaOS 8 allows an unauthenticated attacker on the same network or wireless reach to bypass existing authentication controls. Successful exploitation can expose some data in cleartext, which could enable further compromise of other network infrastructure. HPE rates the issue 8.2 (High) under CVSS 3.1; the CWE classification is disputed between sources.
Affected
- AOS-8.13.0.0 to 8.13.3.0
- AOS-8.10.0.0 to 8.10.0.23
- Default: affected
- AOS-8.12.x is probably affected but unconfirmed.
- End-of-maintenance and end-of-support releases are affected and not patched.
Fixed in
- AOS-8.13.3.1
- AOS-8.10.0.24 and later
- Check the HPE advisory for the exact fixed build of every AOS-8 branch.
Workaround
- Restrict the CLI and web management interfaces to a dedicated layer-2 segment or VLAN and/or control them with layer-3+ firewall policies, with accounting and logging enabled (HPE guidance).
- For end-of-support releases without a fix, isolating the management interface is the only mitigation found.
Exploitation
- At release, HPE was unaware of public exploit code or in-the-wild exploitation.
- Not listed in CISA KEV; CISA SSVC: exploitation none, not automatable.
- No public proof of concept found. Point-in-time check only.
Our recommendation
- Inventory all AOS-8 Mobility Controllers and Instant APs and record exact versions.
- Upgrade to the fixed releases; plan replacement for any end-of-support device.
- Until patched, restrict management interfaces to a management VLAN and filter them with firewall rules.
- Verify the affected version list against the HPE advisory, as public sources disagree.
- Patch this device together with the other critical flaws in the same HPE release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
- VulDB CVE-2026-79884 vuldb.com
- CyberExperts: Aruba AOS wireless patches cyberexperts.com
- Carthage Electronics threat brief carthageelectronics.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:11.
Original description (NVD)
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.