CVE-2026-79844
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an…
- Risk score
- 75/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AOS-10 has authentication bypass vulnerabilities that allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions are met. This could allow an attacker to execute arbitrary commands on the underlying operating system.
- Affected
- {'products': ['AOS-10'], 'packages': [], 'versions': []}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
In the news
TL;DR
HPE patches 8 max-severity RCE and auth bypass AOS flaws, including CVE-2026-79844, in ArubaOS.
- HPE patches 72 vulnerabilities in ArubaOS, including 8 max-severity auth bypass and RCE issues.
- HPE warns customers to patch these security issues as soon as possible and provides mitigation measures.
- Restricting access to AOS management interfaces and using firewall policies can minimize the likelihood of exploitation.
- SecurityWeek reports HPE has not found publicly available proof-of-concept exploit code or evidence of exploitation in the wild.
AI summary of 1 article.
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Last activity 22 Oct 2026. Patch Forecast updates every hour.