CVE-2026-79844

Authentication Bypass Leading to Remote Code Execution in AOS-10

No known exploitation. EPSS puts it in the 52nd percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile52nd0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-22Updated 2026-10-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Hewlett Packard Enterprise (HPE) ArubaOSAffected: ≥ 10.8.0.0, ≤ 10.8.1.1Upgrade to: after 10.8.1.1Affected: ≥ 10.7.0.0, ≤ 10.7.2.6Upgrade to: after 10.7.2.6Affected: ≥ 10.4.0.0, ≤ 10.4.1.13Upgrade to: after 10.4.1.13Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Identify whether your wireless access points, switches, or controllers run Aruba AOS-10 — check with your IT provider or network vendor if unsure.
Check Aruba's security advisories page regularly, since no official patch exists yet for this issue.
In the meantime, restrict management access to AOS-10 devices to trusted internal networks only, not the open internet.
As soon as Aruba releases a fixed version, apply it immediately given the severity of this issue.
Ask your IT team or managed service provider to monitor Aruba's advisories and apply the update the day it ships.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

In plain language

Written by AI from the record

A critical flaw in Aruba's AOS-10 network software could let an attacker skip login entirely and take control of the device, but there's no fix yet and no sign it's being used in attacks right now — businesses running AOS-10 should prepare to patch urgently once one is released.

CWE-288 authentication bypass using an alternate path in AOS-10 allows an unauthenticated network attacker to achieve remote code execution (CVSS 10.0), with no vendor patch currently published and no known public exploit or active exploitation.

If you're affected

Full network device takeover
Network-wide traffic interception
Operational disruption from compromised infrastructure
Pivot point for further attacks
Unauthorized wireless/network access

What is it

Think of this like a master key flaw in the lock on your office's network equipment — someone who finds it could walk in without ever needing a password and take full control. The affected software, AOS-10, runs core networking gear like Wi-Fi access points and controllers that many small businesses rely on for internet and internal network access.

Who is affected

This matters to you if your business uses Aruba AOS-10 on your wireless access points, network controllers, or switches. It's a serious concern specifically for devices whose management interface is reachable from the internet or an untrusted network, since no login is required to exploit it.

How urgent is it

This is a serious, maximum-severity flaw, but it is not yet known to be exploited in the wild, no public exploit code exists, and it is not on the government's confirmed-attacks list — so treat it as a high-priority item to prepare for, not an active emergency. Keep management interfaces off the public internet now, and move fast once Aruba ships a patch, since the ease of exploitation makes this attractive to attackers the moment details or a fix appear.

What to do — in detail

Inventory all Aruba AOS-10 deployments (access points, mobility controllers, gateways) and note their software version and network exposure.
There is currently no vendor patch or fixed version published for CVE-2026-79844 — monitor Aruba's security advisory channel directly for the release, as findings do not yet specify a fixed branch/version.
As an interim workaround, ensure AOS-10 management interfaces (web UI, SSH, APIs) are not exposed to the internet; restrict access via firewall/ACL to trusted admin networks or VPN only.
Given the CVSS 10.0 (AV:N/AC:L/PR:N/UI:N) rating and authentication-bypass-to-RCE path (CWE-288), treat this as a priority for emergency patching the moment a fix ships, even though it's not yet in CISA KEV and no PoC exploit is public.
Monitor Aruba's advisory page and relevant threat intel feeds for exploit code or in-the-wild activity; escalate internal urgency if either KEV listing or public exploit code appears, since that would materially raise the threat level.

Technical context

CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects network-exploitable, low-complexity, no-privilege, no-interaction authentication bypass (CWE-288, use of alternate authentication path/channel) leading to code execution with scope change and full confidentiality/integrity impact. Not listed in CISA KEV; no public exploit code identified; no exploitation reported in news sources. Press attention is newly emerging, which may increase researcher/attacker interest but does not itself indicate active exploitation. No patch/fixed-version information is currently available from vendor sources reviewed.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS52nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 52nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 1 day, from the signal feeds we watch.

2026-10-23Record updatedrecord updated, record updated
2026-10-22Publishedweakness classified, record updated

Affected products

Hewlett Packard Enterprise (HPE)commercial · USaka hewlett packard enterprise
- ArubaOS (AOS)Hardware Firmware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact