CVE-2026-79844: critical vulnerability in Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
Authentication Bypass Leading to Remote Code Execution in AOS-10
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.7%
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)Related CVEs — Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
In the same product, most dangerous first.
CVE-2026-79861CRITICALUnauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10EPSS 1.7%CVE-2026-79846CRITICALUnauthenticated Command Injection Vulnerabilities in AOS-8EPSS 1.6%CVE-2026-95715MEDIUMUnauthenticated Local Command Injection Vulnerability in AOS-10 Command Line InterfaceEPSS 1.6%CVE-2026-79864CRITICALUnauthenticated Adjacent Command Injection Vulnerability in AOS-10EPSS 1.5%CVE-2025-37176MEDIUMAuthenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflowEPSS 1.4%CVE-2026-79857CRITICALUnauthenticated Command Injection Vulnerability in AOS-8 PAPI ProtocolEPSS 1.4%