CVE-2026-79844
CVE-2026-79846 · CVE-2026-79847 · CVE-2026-79848 · CVE-2026-79849 · CVE-2026-79850 · CVE-2026-79851Unauthenticated remote code execution and authentication bypass in ArubaOS
Multiple flaws in HPE ArubaOS (versions AOS-8 and AOS-10) let an unauthenticated remote attacker run arbitrary commands, bypass authentication, or execute code. The vulnerabilities include command injection, buffer overflow, SQL injection, and authentication bypass. HPE has released security updates, though no specific fixed versions are given in the available records.
Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · Updated 28 Oct · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 10.0 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the security updates released by HPE to address these vulnerabilities.
- Restrict network access to the affected management interfaces to trusted hosts only.
- Monitor systems for any signs of unauthorized access or misuse.
What happened
- 23 OctHPE releases security updates addressing eight maximum-severity flaws in ArubaOS.
The 7 records
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-79844 | Authentication Bypass Leading to Remote Code Execution in AOS-10 | critical 10.0 | No | 0.7% |
| CVE-2026-79846 | Unauthenticated Command Injection Vulnerabilities in AOS-8 | critical 10.0 | No | 1.4% |
| CVE-2026-79847 | Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 | critical 10.0 | No | 0.8% |
| CVE-2026-79848 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 | critical 10.0 | No | 0.7% |
| CVE-2026-79849 | Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 | critical 10.0 | No | 0.7% |
| CVE-2026-79850 | Authentication Bypass Leading to Remote Code Execution in AOS-8 | critical 10.0 | No | 0.7% |
| CVE-2026-79851 | Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 | critical 10.0 | No | 0.8% |
The records
CVE-2026-79844 on NVD ↗CVE-2026-79846 on NVD ↗CVE-2026-79847 on NVD ↗CVE-2026-79848 on NVD ↗CVE-2026-79849 on NVD ↗CVE-2026-79850 on NVD ↗CVE-2026-79851 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works