Threat reportVulnerabilityTL-2026-4266
HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass (CVE-2026-79855) - HPESBNW05162
HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass (TL-2026-4266), also tracked as HPESBNW05162, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-23. It has no confirmed attribution, affects HPE Aruba Networking AOS-8 (Mobility Conductors, Mobility Controllers, references 6 CVEs (CVE-2026-79855, CVE-2026-79850, CVE-2026-79845), maps to 7 MITRE ATT&CK techniques (T1005, T1021.004, T1059.004), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4266
- Threat ID
- TL-2026-4266
- Also known as
- HPESBNW05162
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, government administration, education, health, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
- Updates
- 2026-10-23 · revalidated 1× · latest source
How HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass works
HPE Security Bulletin HPESBNW05162 (22 Oct 2026) discloses CVE-2026-79855, a CVSS 9.8 unauthenticated SSH daemon authentication bypass in HPE Aruba AOS-8 that lets a remote attacker gain administrative privileges and fully compromise the host. The bulletin covers 72 vulnerabilities across AOS-8 and AOS-10, eight of them CVSS 10.0; HPE reported no public exploit code or discussion at release.
HPE Security Bulletin HPESBNW05162 rev.1, published 22 October 2026, addresses 72 vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 and AOS-8). The headline issue, CVE-2026-79855, is an authentication bypass in the SSH daemon of AOS-8. NVD scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote, unauthenticated attacker can obtain administrative privileges and fully compromise the affected host. NVD carries no technical description or CWE for this CVE at the time of research, and the NVD record lists AOS-8 versions 8.12.0.0-8.13.3.0 and 8.10.0.0-8.10.0.23 as affected.
The bulletin as a whole is a broad batch of flaws found by HPE internal networking security researchers and external Bugcrowd contributors. Per secondary reporting (GBHackers, SecurityOnline), the 72 CVEs break down into 32 critical (8 at CVSS 10.0), 31 high, 8 medium and 1 low. Of the 72, 58 need no authentication; 32 are reachable over the network, 25 need adjacent network access and 1 needs physical access. Vulnerability classes include authentication bypass, command injection, SQL injection, buffer overflows and memory corruption, path traversal, information disclosure, cross-site scripting, file manipulation and denial of service. Affected components include the PAPI management protocol (UDP/8211), the web-based management interface, the CLI and the SSH daemon.
The eight CVSS 10.0 issues are CVE-2026-79844 (AOS-10 authentication bypass, CWE-288), CVE-2026-79845 (AOS-10 PAPI authentication circumvention, CWE-288), CVE-2026-79846 (AOS-8 command injection), CVE-2026-79847 (AOS-10 buffer overflow, CWE-119), CVE-2026-79848 and CVE-2026-79849 (AOS-8 SQL injection, CWE-89), CVE-2026-79850 (AOS-8 authentication bypass with root execution, CWE-288) and CVE-2026-79851 (AOS-10 buffer overflow, CWE-119). CVE-2026-79852 (CVSS 9.8) is an unauthenticated SQL injection in the web management interface reported as leading to remote code execution. The CVE-to-type mapping comes from a single secondary source and was not confirmed against the HPE bulletin.
Affected deployments: Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points and virtual deployments. Fixed releases are AOS-8 8.13.3.1 and 8.10.0.24, and AOS-10 10.8.1.2, 10.7.2.7 and 10.4.1.14. HPE stated it was unaware of public discussions or exploit code at release, and no in-the-wild exploitation or public PoC has been confirmed. Network-infrastructure management-plane flaws of this kind are high-value targets because compromise of a controller or conductor gives control over the wireless fabric, so rapid patching and management-plane isolation are recommended. The HPE bulletin page itself could not be retrieved during research; details come from NVD and secondary reporting.
MITRE ATT&CK techniques used in TL-2026-4266
Collection
Lateral Movement
T1021.004 Remote Services: SSH; T1210 Exploitation of Remote Services
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
defense-impairment
Affected products and versions in HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass
- HPE Aruba Networking — AOS-8 (Mobility Conductors, Mobility Controllers, Instant APs, virtual deployments)
Vulnerable versions: 8.13.3.0 and earlier (8.12.0.0-8.13.3.0); 8.10.0.23 and earlier (8.10.0.0-8.10.0.23)
Fixed in: 8.13.3.1; 8.10.0.24 - HPE Aruba Networking — AOS-10 (Central-managed Gateways, access points, virtual deployments)
Vulnerable versions: 10.8.1.1 and earlier; 10.7.2.6 and earlier; 10.4.1.13 and earlier
Fixed in: 10.8.1.2; 10.7.2.7; 10.4.1.14
Remediation for HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass
Patches
- AOS-8: 8.13.3.1, 8.10.0.24
- AOS-10: 10.8.1.2, 10.7.2.7, 10.4.1.14
Immediate actions
- Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24 and AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14
- Restrict SSH, CLI, web-management and PAPI (UDP/8211) access to trusted management networks only
- Review SSH and management-plane authentication logs on Mobility Conductors, Controllers and Gateways for unexpected administrative sessions
Workarounds
- Isolate command-line and web-management interfaces on a dedicated Layer 2 segment or VLAN
- Enforce Layer 3 or higher firewall controls in front of management interfaces
- Implement accounting mechanisms for administrative sessions
Longer-term hardening
- Keep management interfaces off untrusted networks and enforce Layer 3+ firewall controls
- Enable accounting (AAA) for administrative access to controllers and conductors
- Subscribe to HPE security bulletins and track the 72 CVEs in HPESBNW05162
CVEs associated with HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass
CVE-2026-79855, CVE-2026-79850, CVE-2026-79845, CVE-2026-79847, CVE-2026-79851, CVE-2026-79860
Weaknesses (CWE) in HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass
Timeline of HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass
- HPE publishes earlier AOS-8/AOS-10 bulletin HPESBNW04987 for Mobility Conductors, Controllers and Gateways (prior advisory series; date approximate, month only)
- HPE releases further ArubaOS security advisories (e.g. HPESBNW05048/05049) covering AOS-10.8.x, 10.7.x, 10.4.x, 8.13.x, 8.12.x and 8.10.x
- Fixed releases available: AOS-8 8.13.3.1 and 8.10.0.24; AOS-10 10.8.1.2, 10.7.2.7 and 10.4.1.14
- CVE-2026-79855 published in NVD with CVSS 3.1 base score 9.8 and no technical description
- HPE publishes HPESBNW05162 rev.1 documenting 72 vulnerabilities in AOS-8 and AOS-10, including CVE-2026-79855 (SSH authentication bypass, CVSS 9.8)
- CISA KEV catalog checked during research; none of the tracked CVEs (CVE-2026-79850, -79855, -79845, -79847, -79851, -79860) were listed.
- GBHackers and SecurityOnline report the bulletin; HPE states it is unaware of public discussions or exploit code and no active exploitation is confirmed
Update history for TL-2026-4266
- 2026-10-23 — HPE Aruba Networking AOS-8/AOS-10 Critical Flaws (CVSS 10.0) Enabling Unauthenticated Device Takeover (CVE-2026-79850, CVE-2026-79855, CVE-2026-79845, CVE-2026-79847, CVE-2026-79851, CVE-2026-79860): What changed No severity, exploitability or status change; existing values stand. The newer report's 10.0 score applies to other CVEs in the bulletin, not to CVE-2026-79855 (9.8), so cvss_score is left unchanged. New indicators (3) Three be
Sources cited for HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass
- HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)
- NVD - CVE-2026-79855
- Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
- HPE Patches 72 Flaws in AOS-8 and AOS-10, Including Eight CVSS 10.0 Bugs
- HPESBNW04987 rev.3 - Multiple Vulnerabilities in HPE Aruba Networking AOS-8 and AOS-10 for Mobility Conductors, Controllers, and Gateways
Detection coverage for TL-2026-4266
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4266 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.