CVE-2026-79846

Unauthenticated Command Injection Vulnerabilities in AOS-8

No known exploitation. EPSS puts it in the 72nd percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile72nd1.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-22Updated 2026-10-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Hewlett Packard Enterprise (HPE) ArubaOSAffected: ≥ 8.13.0.0, ≤ 8.13.3.0Upgrade to: after 8.13.3.0Affected: ≥ 8.10.0.0, ≤ 8.10.0.23Upgrade to: after 8.10.0.23Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Ask your IT provider or network admin whether your organization uses Aruba wireless controllers or switches running AOS-8.
Confirm whether the management interface of those devices is reachable from the internet; if so, restrict access immediately to trusted internal networks only.
Check Aruba's security advisories regularly for a patch, since none is currently available.
Once Aruba releases a fixed AOS-8 version, schedule the upgrade as a priority.
In the meantime, limit who can reach the controller's management ports and monitor for unusual device behavior.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

In plain language

Written by AI from the record

A critical, unauthenticated bug in Aruba's AOS-8 network controller software could let an attacker take over affected devices without a password, but there is no sign of active attacks yet and no fix has been released, so you should check your network gear now and watch for a patch.

An unauthenticated command injection flaw in AOS-8 (Aruba Networks' wireless/network controller OS) allows arbitrary command execution with no credentials and no user interaction, rated CVSS 10.0, with no vendor patch yet available and no confirmed in-the-wild exploitation.

If you're affected

Full network controller takeover
Network-wide outage risk
Traffic interception or rerouting
Entry point for further intrusion

What is it

Think of AOS-8 as the 'brain' that runs your business Wi-Fi and network switches behind the scenes. This flaw is like a backdoor that lets a stranger give commands directly to that brain without ever needing a key or password, potentially letting them control or disrupt your whole network.

Who is affected

This matters to you if your business uses Aruba Networks wireless controllers or switches running the AOS-8 operating system. It is a real risk mainly if the device's management interface is reachable from the internet or an untrusted network; devices only accessible from a tightly controlled internal network face much lower exposure.

How urgent is it

This is a serious flaw — a perfect severity score and no login required — but there is no confirmed evidence yet that attackers are exploiting it, and no public attack code exists. Because there is also no patch available yet, you should take protective steps now (restrict network access) and watch closely for Aruba's fix, rather than panic.

What to do — in detail

Inventory all AOS-8-based Aruba controllers and switches in your environment and note firmware versions.
Verify whether management interfaces (web UI, API, SSH) are exposed to the internet or any untrusted segment; if so, firewall them to management-only VLANs or VPN access immediately.
Monitor Aruba's security bulletin page for CVE-2026-79846, since no fixed version is published yet at this time.
Once a patch is released, prioritize deployment given the CVSS 10.0 / AV:N/AC:L/PR:N/UI:N rating, which indicates network-reachable, no-auth, no-interaction command execution with full confidentiality/integrity/availability impact.
As a temporary workaround, disable or restrict any unnecessary management services on affected devices and enable logging/alerting on the controller for unexpected process execution or configuration changes.
There is currently no CISA KEV listing and no public exploit code, so this is not yet confirmed as actively exploited — reassess priority if that changes.

Technical context

CVSS 3.1 score 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network-exploitable, low-complexity, no-privilege, no-interaction command injection with complete confidentiality, integrity, and availability impact and a changed scope. No CISA KEV listing exists, no public exploit code has been identified, and no patch/fix version has been published by the vendor at this time. Press attention is newly emerging but does not itself indicate exploitation. Exploit maturity is therefore theoretical/unconfirmed, warranting an elevated-but-not-critical operational response pending patch availability.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS72nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.4% chance of exploitation activity in the next 30 days, which ranks it in the 72nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

4 events over 1 day, from the signal feeds we watch.

2026-10-23Record updatedrecord updated, record updated
2026-10-22Published

Affected products

Hewlett Packard Enterprise (HPE)commercial · USaka hewlett packard enterprise
- ArubaOS (AOS)Hardware Firmware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Sources

References in the record

support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US

In the news

HPE patches eight max severity RCE and auth bypass AOS flawsBleepingComputer · 2026-10-23

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for ArubaOS (AOS), not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account