Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ArubaOS 8 SSH service lets remote attacker take control

CVE-2026-79855 · published 2 days ago
Summary

The SSH component in ArubaOS 8 can be tricked into allowing access without a valid login. This lets an outside attacker log in as an administrator and control the entire system. Apply the latest security update from HPE or disable SSH until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hewlett packard enterprise (hpe) unknown product <= 8.13.3.0
hewlett packard enterprise (hpe) arubaos (aos) <= 8.13.3.0
Original advisory text
Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published22 Oct 2026
Updated25 Oct 2026
First seen22 Oct 2026
Sources
CVE-2026-79855 · NVD
CVE-2026-79855 · MITRE
Track software like this
Free during beta