CVE-2026-79889

Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution

Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79890

Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol

There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79891

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8

A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79892

Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8

A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79893

Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10

Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79895

Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10

Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79955

Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8

An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79956

Improper Sanitization leads to Command Injection in AOS-8 Web Interface

A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95704

Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface

A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95705

Authenticated Command Injection Vulnerabilities in AOS-8

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95707

Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8

A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95708

Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95709

Authenticated Command Injection Vulnerabilities in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95711

Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface

An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95713

Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface

An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95714

Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95715

Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface

An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95716

Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes

An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95717

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95718

Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos