HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
CVE-2026-79871
Unauthenticated info disclosure in HPE AOS-10 CLI
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A sensitive information disclosure flaw in the AOS-10 command line interface lets an unauthenticated attacker on an adjacent network retrieve sensitive data without user interaction. The retrieved information may be used to gain further access to network services that AOS-10 supports. HPE has not listed affected builds or a fixed release.
What to do: HPE has not listed a fixed version for CVE-2026-79871. Apply HPE's update for this CVE when one is published.
| Product | Affected |
|---|---|
| HPE AOS-10 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H