{"id":"CVE-2026-79850","published":"2026-10-22T19:17:57.183","lastModified":"2026-10-26T14:18:54.933","description":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-288"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An authentication bypass vulnerability in AOS-8 allows unauthenticated remote attackers to execute arbitrary commands as root on the underlying host, leading to full system compromise.","exploitability":"Exploitation requires no authentication or user interaction and likely leverages flawed access control logic in a network-exposed interface.","blast_radius":"Successful exploitation grants full root-level control of the affected device, enabling complete data exfiltration, persistence, or lateral movement within the infrastructure.","remediation":"Upgrade to AOS-8 patch level 2.590 or later, as specified in the vendor advisory; if no fixed version is published, disable the affected interface and restrict access to the named endpoint pending further guidance.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","remote-exploit","privilege-escalation","network-exposed"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:48:01.496Z"}}