Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-79846: HP ArubaOS 8 can let remote attacker run commands
CVE-2026-79846 · published 2 days ago
Summary
The ArubaOS 8 software in HPE devices contains a flaw that lets anyone on the network send specially crafted requests and cause the system to execute commands it shouldn't. If exploited, an attacker could take control of the underlying computer and manipulate data or services. Apply the vendor's security update or disable the vulnerable interface until a patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hewlett packard enterprise (hpe) | unknown product | <= 8.13.3.0 |
| hewlett packard enterprise (hpe) | arubaos (aos) | <= 8.13.3.0 |
Original advisory text
Unauthenticated Command Injection Vulnerabilities in AOS-8
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published22 Oct 2026
Updated25 Oct 2026
First seen22 Oct 2026
Track software like this
Free during beta