CVE-2026-79850
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker…
- Risk score
- 75/100
- CVSS
- 10.0 v3.1
- Exploit chance (30 days)
- 0.7%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AOS-8 has a vulnerability that allows an unauthenticated remote attacker to bypass authentication controls and run arbitrary commands as root, leading to complete system compromise.
- Affected
- {'products': ['AOS-8'], 'packages': [], 'versions': []}
- Fix
- Check the linked advisory for a fix, as none is provided.
- Exploitation
- No known exploitation
In the news
TL;DR
HPE patches 8 critical RCE and auth bypass flaws in ArubaOS, affecting multiple versions of AOS-8 and AOS-10.
- HPE released security updates to patch 72 vulnerabilities, including 8 max-severity issues.
- The flaws can be exploited by remote threat actors without privileges through low-complexity attacks.
- HPE recommends restricting access to AOS management interfaces and using firewall policies and accounting controls.
AI summary of 1 article.
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Last activity 22 Oct 2026. Patch Forecast updates every hour.