{"id":"CVE-2026-79846","published":"2026-10-22T19:17:56.490","lastModified":"2026-10-26T14:18:54.933","description":"Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Command injection flaw in AOS-8's affected interface allows unauthenticated remote attackers to execute arbitrary commands on the underlying OS if specific preconditions—outside the attacker’s control—are met, risking full system compromise.","exploitability":"Exploitation requires meeting preconditions beyond the attacker’s control, making reliable exploitation difficult without additional information or access.","blast_radius":"Successful exploitation grants full remote code execution on the host, enabling complete data theft, system takeover, and lateral movement within the network.","remediation":"Upgrade to AOS-8 version 2.590 or later, as this is the fixed version specified in the vendor advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","unauthenticated","aos-8"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:47:22.037Z"}}