Hewlett Packard Enterprise (HPE) ArubaOS (AOS) vulnerabilities

CVE-2026-79865 Critical · 9.6 Oct 22, 2026

Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10

A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79864 Critical · 9.6 Oct 22, 2026

Unauthenticated Adjacent Command Injection Vulnerability in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVE-2026-79863 Critical · 9.6 Oct 22, 2026

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79862 Critical · 9.6 Oct 22, 2026

Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution

Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79861 Critical · 9.8 Oct 22, 2026

Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10

There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79860 Critical · 9.8 Oct 22, 2026

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79859 Critical · 9.8 Oct 22, 2026

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8

Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79858 Critical · 9.8 Oct 22, 2026

Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.

CVE-2026-79849 Critical · 10.0 CWE-89 Oct 22, 2026

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-79857 Critical · 9.8 CWE-77 Oct 22, 2026

Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol

There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79856 Critical · 9.8 CWE-119 Oct 22, 2026

Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8

A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

CVE-2026-79855 Critical · 9.8 CWE-288 Oct 22, 2026

Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise

An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.

CVE-2026-79854 Critical · 9.8 CWE-89 Oct 22, 2026

Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10

A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-79853 Critical · 9.8 Oct 22, 2026

Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10

Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-79852 Critical · 9.8 CWE-89 Oct 22, 2026

Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-79851 Critical · 10.0 CWE-119 Oct 22, 2026

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.

CVE-2026-79850 Critical · 10.0 CWE-288 Oct 22, 2026

Authentication Bypass Leading to Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.

CVE-2026-79848 Critical · 10.0 CWE-89 Oct 22, 2026

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-79847 Critical · 10.0 CWE-119 Oct 22, 2026

Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10

Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVE-2026-79846 Critical · 10.0 Oct 22, 2026

Unauthenticated Command Injection Vulnerabilities in AOS-8

Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-79844 Critical · 10.0 CWE-288 Oct 22, 2026

Authentication Bypass Leading to Remote Code Execution in AOS-10

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-23823 High · 7.2 CWE-77 May 12, 2026

Authenticated Command Injection leads to RCE in AOS-10 CLI Command

A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.

CVE-2026-23822 Medium · 5.3 CWE-776 May 12, 2026

Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service

A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x

CVE-2026-23821 High · 7.2 CWE-78 May 12, 2026

Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI

A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.

CVE-2026-23820 High · 7.2 CWE-78 May 12, 2026

Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.