CVE-2026-95715: medium-severity vulnerability in Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 1.6%
An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)Related CVEs — Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
In the same product, most dangerous first.
CVE-2026-79861CRITICALUnauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10EPSS 1.7%CVE-2026-79846CRITICALUnauthenticated Command Injection Vulnerabilities in AOS-8EPSS 1.6%CVE-2026-79864CRITICALUnauthenticated Adjacent Command Injection Vulnerability in AOS-10EPSS 1.5%CVE-2025-37176MEDIUMAuthenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflowEPSS 1.4%CVE-2026-79857CRITICALUnauthenticated Command Injection Vulnerability in AOS-8 PAPI ProtocolEPSS 1.4%CVE-2025-37171HIGHAuthenticated Command Injection Vulnerabilities in AOS-8 Web-Based Management InterfaceEPSS 1.4%