HPE patches eight maximum-severity RCE and auth-bypass flaws in ArubaOS
The eight flaws hit AOS-8 and AOS-10 and can be exploited remotely without privileges or user interaction.
76
CVE-2026-79850
Unauthenticated root command execution in HPE Aruba AOS-8
- CVSS 3.1
- 10.0 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An authentication-bypass flaw in an affected AOS-8 interface lets a remote attacker skip existing controls and run arbitrary commands on the host. No credentials or user interaction are required. Successful exploitation runs commands as root and can fully compromise the device. Aruba networking systems running the affected AOS-8 interface are at risk.
What to do: Apply HPE's update for CVE-2026-79850. HPE has not listed a fixed version or workaround.
| Product | Affected |
|---|---|
| HPE Aruba AOS-8 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
- Weakness
- CWE-288
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
In the news
3 storiesHPE patches critical Aruba AOS flaws that can fully control devices
Eight CVEs score CVSS 10.0; unauthenticated AOS-8 flaws can run commands as root, and HPE knew of no public exploit code.
74
HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72