CVE-2026-79887

Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)

State: Published
Severity: 8.1 High
Published: Oct 22, 2026
Updated: Oct 24, 2026
Reserved: Aug 25, 2026

Description

A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	hpe

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
ArubaOS (AOS)Hewlett Packard Enterprise (HPE)	8.13.0.0 through 8.13.3.0Affected 8.10.0.0 through 8.10.0.23Affected

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.