HPE AOS-8: Authentication bypass in web interface enables remote code execution
Summary
HPE ArubaOS AOS-8 controllers and gateways contain a flaw in the web interface that allows an unauthenticated remote attacker to execute code on the device. Successful exploitation could give the attacker full control of the device, allow interception of network traffic and open a path into connected systems. The CVSS score of 8.1 reflects high attack complexity, but no authentication is required according to the CVE record.
Affected
- ArubaOS AOS-8 8.13.0.0 to 8.13.3.0 (according to secondary coverage of the HPE advisory)
- ArubaOS AOS-8 8.10.0.0 to 8.10.0.23 (according to secondary coverage of the HPE advisory)
- Discrepancy: one database also lists 8.12.x; this is not confirmed. Check the HPE advisory.
- Unsupported branches: exposure has not been assessed.
Fixed in
- AOS-8 8.13.3.1
- AOS-8 8.10.0.24
- Later releases containing the fix (according to secondary coverage; verify against the HPE advisory)
Workaround
- Restrict the web and CLI management interfaces to a dedicated Layer 2 segment or VLAN.
- Apply firewall controls at Layer 3 and above and block internet access to the management interfaces.
- Enable accounting controls to track user activities and resource usage.
Exploitation
- No evidence of exploitation in the wild, according to HPE (secondary source).
- No public proof-of-concept or exploit code known.
- Not listed in CISA KEV; EPSS 0.00000; CISA SSVC exploitation: none, automatable: no, technical impact: total.
Our recommendation
- Confirm the device model, AOS-8 branch and exact build against the HPE advisory HPESBNW05162.
- Upgrade to AOS-8 8.13.3.1 or 8.10.0.24 (or later), or the fixed release for your branch.
- Until patched, restrict the web and CLI interfaces to a management VLAN and block internet access to them (typically HTTPS port 4343 on AOS-8 controllers).
- Review logs for unexpected logins or configuration changes, especially before patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- Cyberpress: Critical HPE Aruba AOS-8 vulnerability cyberpress.org
- Rescana: HPE Aruba AOS analysis www.rescana.com
- TechBytes: HPE patches AOS RCE and auth bypass techbytes.app
- Safeguard.sh: HPE Aruba AOS-8/AOS-10 vulnerabilities safeguard.sh
- Offseq CVE record CVE-2026-79887 radar.offseq.com
- VulDB CVE-2026-79887 vuldb.com
- Vulners CNNVD-2026-81838460 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:03.
Original description (NVD)
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.