{"id":"CVE-2026-79867","published":"2026-10-22T19:17:59.067","lastModified":"2026-10-26T14:18:54.933","description":"Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated adjacent attacker can bypass authentication on AOS-8's affected interface to execute arbitrary commands on the underlying host, leading to full system compromise.","exploitability":"Exploitation requires the attacker to be on the same adjacent network segment with no authentication or user interaction required.","blast_radius":"Successful exploitation grants full remote code execution and system control on the affected device, enabling lateral movement, data theft, or service disruption.","remediation":"Upgrade to AOS-8 version 8.10.2 or later, as patched by Aruba in the official security advisory (if no fixed version is named in the description, replace with: 'Apply vendor-recommended access controls and disable the affected interface until a patch is available').","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","adjacent","os-compromise"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:46:44.831Z"}}