CVE-2026-79846
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an…
- Risk score
- 79/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 1.4%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AOS-8 has command injection vulnerabilities that allow an unauthenticated remote attacker to run arbitrary commands on the underlying host.
- Affected
- {'products': ['AOS-8'], 'packages': [], 'versions': []}
- Fix
- Check the linked advisory for details on the fix.
- Exploitation
- No known exploitation
In the news
TL;DR
HPE patches 8 critical RCE and auth bypass flaws in ArubaOS, including CVE-2026-79846, which can be exploited by remote attackers without privileges.
- HPE warns customers to patch ASAP due to complexity, breadth, and impact of vulnerabilities.
- Mitigation measures include restricting access to AOS management interfaces and using firewall policies.
- No publicly available proof-of-concept exploit code has been found, but HPE recommends patching as soon as possible.
- ArubaOS powers enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices.
AI summary of 1 article.
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Last activity 22 Oct 2026. Patch Forecast updates every hour.