CVE-2026-79869

Authentication Bypass Leading to Remote Code Execution in AOS-10

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79877

Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10

A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79880

Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8

A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79883

Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10

A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79876

Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing

A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79867

Authentication Bypass Leading to Remote Code Execution in AOS-8

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79875

Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79858

Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79859

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79864

Unauthenticated Adjacent Command Injection Vulnerability in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS 1.5% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79860

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79862

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79863

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79884

Authentication Bypass leads to Sensitive Information Disclosure in AOS-8

A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79882

Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10

There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79881

Authentication Bypass Leading to Remote Code Execution in AOS-8

An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79879

Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10

Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79878

Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol

A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79846

Unauthenticated Command Injection Vulnerabilities in AOS-8

Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 10 Critical EPSS 1.6% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79868

Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8

Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos