# HPE Aruba AOS-8/AOS-10 SSH Authentication Bypass (CVE-2026-79855) - HPESBNW05162

> HPE Security Bulletin HPESBNW05162 (22 Oct 2026) discloses CVE-2026-79855, a CVSS 9.8 unauthenticated SSH daemon authentication bypass in HPE Aruba AOS-8 that lets a remote attacker gain administrative privileges and fully compromise the host. The bulletin covers 72 vulnerabilities across AOS-8 and AOS-10, eight of them CVSS 10.0; HPE reported no public exploit code or discussion at release.

- **Published:** 2026-10-23T12:35:41Z
- **Last reviewed:** 2026-10-23T15:12:29.968Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4266
- **ID:** TL-2026-4266
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-79855, CVE-2026-79850, CVE-2026-79845, CVE-2026-79847, CVE-2026-79851, CVE-2026-79860

## Description

HPE Security Bulletin HPESBNW05162 rev.1, published 22 October 2026, addresses 72 vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 and AOS-8). The headline issue, CVE-2026-79855, is an authentication bypass in the SSH daemon of AOS-8. NVD scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote, unauthenticated attacker can obtain administrative privileges and fully compromise the affected host. NVD carries no technical description or CWE for this CVE at the time of research, and the NVD record lists AOS-8 versions 8.12.0.0-8.13.3.0 and 8.10.0.0-8.10.0.23 as affected.

The bulletin as a whole is a broad batch of flaws found by HPE internal networking security researchers and external Bugcrowd contributors. Per secondary reporting (GBHackers, SecurityOnline), the 72 CVEs break down into 32 critical (8 at CVSS 10.0), 31 high, 8 medium and 1 low. Of the 72, 58 need no authentication; 32 are reachable over the network, 25 need adjacent network access and 1 needs physical access. Vulnerability classes include authentication bypass, command injection, SQL injection, buffer overflows and memory corruption, path traversal, information disclosure, cross-site scripting, file manipulation and denial of service. Affected components include the PAPI management protocol (UDP/8211), the web-based management interface, the CLI and the SSH daemon.

The eight CVSS 10.0 issues are CVE-2026-79844 (AOS-10 authentication bypass, CWE-288), CVE-2026-79845 (AOS-10 PAPI authentication circumvention, CWE-288), CVE-2026-79846 (AOS-8 command injection), CVE-2026-79847 (AOS-10 buffer overflow, CWE-119), CVE-2026-79848 and CVE-2026-79849 (AOS-8 SQL injection, CWE-89), CVE-2026-79850 (AOS-8 authentication bypass with root execution, CWE-288) and CVE-2026-79851 (AOS-10 buffer overflow, CWE-119). CVE-2026-79852 (CVSS 9.8) is an unauthenticated SQL injection in the web management interface reported as leading to remote code execution. The CVE-to-type mapping comes from a single secondary source and was not confirmed against the HPE bulletin.

Affected deployments: Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points and virtual deployments. Fixed releases are AOS-8 8.13.3.1 and 8.10.0.24, and AOS-10 10.8.1.2, 10.7.2.7 and 10.4.1.14. HPE stated it was unaware of public discussions or exploit code at release, and no in-the-wild exploitation or public PoC has been confirmed. Network-infrastructure management-plane flaws of this kind are high-value targets because compromise of a controller or conductor gives control over the wireless fabric, so rapid patching and management-plane isolation are recommended. The HPE bulletin page itself could not be retrieved during research; details come from NVD and secondary reporting.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1021.004 Remote Services: SSH
- T1556 Modify Authentication Process
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1210 Exploitation of Remote Services
- T1005 Data from Local System

## Sources

- [HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US)
- [NVD - CVE-2026-79855](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-79855)
- [Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems](https://gbhackers.com/critical-hpe-aruba-aos-8-flaw/)
- [HPE Patches 72 Flaws in AOS-8 and AOS-10, Including Eight CVSS 10.0 Bugs](https://securityonline.info/hpe-networking-aos-vulnerabilities/)
- [HPESBNW04987 rev.3 - Multiple Vulnerabilities in HPE Aruba Networking AOS-8 and AOS-10 for Mobility Conductors, Controllers, and Gateways](https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04987en_us&docLocale=en_US)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4266