Authentication Bypass Leading to Remote Code Execution in AOS-8 (Hewlett Packard Enterprise (HPE) ArubaOS (AOS))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.69 % · percentile 53 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Awaiting Analysis
Description
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
Weaknesses (CWE)
- CWE-288 — Authentication Bypass Using an Alternate Path or Channel
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | hpe |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | NVD · security-alert@hpe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-108350
- GCVE · GCVE-0-2026-79850
CERT-FR advisories
- CERTFR-2026-AVI-1369 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · ArubaOS (AOS) | affected 8.13.0.0 ≤ 8.13.3.0 ; affected 8.10.0.0 ≤ 8.10.0.23 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |