HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Original title: Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
HPE fixed a critical SSH authentication-bypass flaw, CVE-2026-79855 (CVSS 9.8), in AOS-8 that could let a remote unauthenticated attacker gain administrative privileges and fully compromise a host. The October 22 bulletin HPESBNW05162 documents 72 vulnerabilities in AOS-8 and AOS-10, including several CVSS 10.0 issues that enable unauthenticated remote code execution. Affected builds include AOS-10 10.8.1.1 and earlier, 10.7.2.6 and earlier, and 10.4.1.13 and earlier, plus AOS-8 8.13.3.0 and earlier or 8.10.0.23 and earlier. HPE said it knew of no public exploit code when the bulletin was released.
Unconfirmed: HPE said it was unaware of public discussion or exploit code when the bulletin was released.
- CVE-2026-79855 is an AOS-8 SSH authentication bypass scored CVSS 9.8.
- Fixes are AOS-10 10.8.1.2, 10.7.2.7, or 10.4.1.14, and AOS-8 8.13.3.1 or 8.10.0.24.
- PAPI issues include CVE-2026-79860, a buffer overflow on UDP port 8211.
- Exposure includes Mobility Conductors, Controllers, gateways, access points, and virtual deployments.
- If patching is delayed, isolate management interfaces and enforce firewall controls.
Impact: Unauthenticated admin access, remote code execution, or data exposure
| Product | Affected | Fixed in |
|---|---|---|
| HPE Aruba AOS-8 | 8.13.3.0 and earlier, or 8.10.0.23 and earlier | 8.13.3.1 or 8.10.0.24 |
| HPE Aruba AOS-10 | 10.8.1.1 and earlier, 10.7.2.6 and earlier, and 10.4.1.13 and earlier | 10.8.1.2, 10.7.2.7, or 10.4.1.14 |
- 1.Upgrade AOS-10 to 10.8.1.2, 10.7.2.7, or 10.4.1.14 and AOS-8 to 8.13.3.1 or 8.10.0.24.
- 2.If upgrades must wait, isolate management interfaces and enforce Layer 3 firewall controls.
- 3.Inventory versions, review management logs, and rotate credentials if compromise is suspected.
- CVEs
- CVE-2026-79844CVE-2026-79845CVE-2026-79846CVE-2026-79847CVE-2026-79848CVE-2026-79849CVE-2026-79850CVE-2026-79851CVE-2026-79852CVE-2026-79853CVE-2026-79854CVE-2026-79855CVE-2026-79856CVE-2026-79857CVE-2026-79858CVE-2026-79859CVE-2026-79860CVE-2026-79861CVE-2026-79862CVE-2026-79863CVE-2026-79864CVE-2026-79865CVE-2026-79866CVE-2026-79867CVE-2026-79868CVE-2026-79869CVE-2026-79870CVE-2026-79871CVE-2026-79872CVE-2026-79873
- Vendors
- Hewlett Packard Enterprise
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79844 | Authentication bypass in HPE AOS-10 under external preconditions | 10.0 group max | — | ||
| CVE-2026-79845 | A vulnerability was identified in code-projects Simple Inventory System 1.0 | 5.5 | <1% | ||
| CVE-2026-79846 | Unauthenticated command injection in HPE Aruba AOS-8 | 10.0 group max | — | ||
| CVE-2026-79852 | Unauthenticated SQL injection to OS commands in AOS web UI | 9.8 | — | ||
| CVE-2026-79861 | Unauthenticated command injection RCE in AOS-10 via PAPI | 9.8 | — |
From the original article
5 min read at gbhackers.com
Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system. This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attacker gain administrative privileges and fully compromise an affected host. It has a CVSS v3.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.