Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-79853: ArubaOS 10 lets unauthenticated attacker run commands
CVE-2026-79853 · published 2 days ago
Summary
A remote attacker who does not need to log in can view confidential information on devices running ArubaOS 10 and then issue any command to the underlying system. This could let the attacker take control of the device or disrupt services. Install the latest security updates from HPE and limit network access to the management interface.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hewlett packard enterprise (hpe) | unknown product | <= 10.8.1.1 |
| hewlett packard enterprise (hpe) | arubaos (aos) | <= 10.8.1.1 |
Original advisory text
Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published22 Oct 2026
Updated25 Oct 2026
First seen22 Oct 2026
Track software like this
Free during beta