HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
CVE-2026-79853
Unauthenticated info leak and command execution in AOS-10
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Sensitive information disclosure in an affected interface of HPE Aruba AOS-10 lets an unauthenticated remote attacker read sensitive information from the system. Successful exploitation can also let the attacker run arbitrary commands on the underlying operating system. No affected builds or fixed releases are listed.
What to do: Apply HPE's update for CVE-2026-79853. HPE has not listed affected builds or a fixed version.
| Product | Affected |
|---|---|
| HPE AOS-10 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H