{"id":"CVE-2026-79844","published":"2026-10-22T19:17:56.367","lastModified":"2026-10-26T14:18:54.933","description":"Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-288"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The AOS-10 interface contains an authentication bypass vulnerability (CWE-288) that, under specific preconditions outside the attacker’s control, allows unauthenticated remote command execution on the underlying host.","exploitability":"Exploitation requires meeting external preconditions not controllable by the attacker, making reliable exploitation unlikely without additional information or insider conditions.","blast_radius":"If successfully exploited, an attacker could execute arbitrary commands on the host OS, potentially compromising confidentiality and integrity of the system, though availability impact is absent per CVSS.","remediation":"No fixed version is published in the description; disable the affected interface or restrict access to it until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","rce","remote-exploit","aos-10","cwe-288"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:47:08.656Z"}}