---
id: CVE-2026-79850
title: Authentication Bypass Leading to Remote Code Execution in AOS-8
summary: >-
  Vulnerabilities in the affected interface of AOS-8 could allow an
  unauthenticated remote attacker to bypass existing authentication controls and
  run arbitrary commands on the underlying host. Successful exploitation could
  allow an attack…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-22T20:18:35.897306Z'
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T19:12:43.883Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79850'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.004
epssPercentile: 0.33077
ingestedAt: '2026-10-22T22:00:50.419Z'
---

## Overview

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

## Affected

- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.