Hewlett Packard Enterprise (HPE) has addressed a critical authentication-bypass vulnerability in the SSH daemon of its AOS-8 wireless operating system.
This vulnerability, tracked as CVE-2026-79855, could let a remote, unauthenticated attacker gain administrative privileges and fully compromise an affected host.
It has a CVSS v3.1 score of 9.8, indicating a high severity. Attackers can exploit the vulnerability over a network with low complexity, without credentials or user interaction, and it on significantly impact confidentiality, integrity, and availability.
HPE credited its internal networking security researchers for identifying this issue. The larger HPESBNW05162 security bulletin, published on October 22, 202, details the SSH vulnerability6.
The bulletin documents 72 vulnerabilities across AOS-8 and AOS-10, including authentication bypasses, command and SQL injection, buffer overflows, memory corruption, path traversal, information disclosure, cross-site scripting, file manipulation, and denial-of-service conditions.
Several of these vulnerabilities received the maximum CVSS score of 10.0 and enable unauthenticated remote code execution.
Affected software versions include AOS-10 10.8.1.1 and earlier, 10.7.2.6 and earlier, and 10.4.1.13 and earlier within the supported branches.
AOS-8 installations running 8.13.3.0 and earlier or 8.10.0.23 and earlier are also vulnerable. The exposure extends to compatible Mobility Conductors, Mobility Controllers, Central-managed Mobility Gateways, AOS-10 access points, AOS-8 Instant access points, and associated virtual deployments.
Attackers could exploit various weaknesses to gain privileged control, alter wireless configurations, access sensitive data, compromise filesystems, disrupt network services, or execute code on the underlying operating system. Particularly concerning issues affect the PAPI access-point management protocol.
For example, CVE-2026-79860 targets UDP port 8211 with crafted packets. Other PAPI vulnerabilities also allow command injection, SQL injection, buffer overflows, or authentication bypass.
Administrators are urged to upgrade immediately to AOS-10 10.8.1.2, 10.7.2.7, or 10.4.1.14, depending on their release branch. AOS-8 users should update to 8.13.3.1 or 8.10.0.24.
HPE said it was unaware of any public discussions or exploit code related to these vulnerabilities when it released the bulletin, but emphasized the need for rapid patching because of their breadth, complexity, and potential impact.
If immediate upgrades are not feasible, HPE recommends isolating command-line and web-management interfaces on a dedicated Layer 2 segment or VLAN, enforcing Layer 3 or higher firewall controls, and implementing accounting mechanisms to track and log user activity and resource usage. While these measures can reduce exposure, they do not replace the need for vendor fixes.
The advisory underscores the importance of limiting access to the management plane. Many vulnerabilities don’t require privileges or user interaction, making exposed administrative services a potential pathway to compromise infrastructure.
Security teams should inventory appliance and virtual instances, verify the software versions in use, review firewall and authentication logs for management access, and prioritize systems that are internet-accessible or reachable before addressing other deployments. Also, rotate credentials if a compromise is suspected.
All CVE Details
| CVE | Product | Vulnerability / impact | Reach | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79844 | AOS-10 | Authentication bypass leading to RCE | Remote | 10.0 Critical |
| CVE-2026-79845 | AOS-10 | PAPI authentication bypass; unauthorized access/data modification | Remote | 10.0 Critical |
| CVE-2026-79846 | AOS-8 | Unauthenticated command injection/RCE | Remote | 10.0 Critical |
| CVE-2026-79847 | AOS-10 | Buffer overflow/RCE | Remote | 10.0 Critical |
| CVE-2026-79848 | AOS-8 | SQL injection/RCE | Remote | 10.0 Critical |
| CVE-2026-79849 | AOS-8 | SQL injection/RCE | Remote | 10.0 Critical |
| CVE-2026-79850 | AOS-8 | Authentication bypass/root command execution | Remote | 10.0 Critical |
| CVE-2026-79851 | AOS-10 | Buffer overflow/RCE | Remote | 10.0 Critical |
| CVE-2026-79852 | AOS-8 & AOS-10 | Web-management SQL injection/RCE | Remote | 9.8 Critical |
| CVE-2026-79853 | AOS-10 | Information disclosure leading to RCE | Remote | 9.8 Critical |
| CVE-2026-79854 | AOS-10 | SQL injection/RCE | Remote | 9.8 Critical |
| CVE-2026-79855 | AOS-8 | SSH authentication bypass/complete compromise | Remote | 9.8 Critical |
| CVE-2026-79856 | AOS-8 | PAPI buffer overflow/authentication bypass | Remote | 9.8 Critical |
| CVE-2026-79857 | AOS-8 | PAPI command injection/RCE | Remote | 9.8 Critical |
| CVE-2026-79858 | AOS-8 | PAPI SQL injection | Remote | 9.8 Critical |
| CVE-2026-79859 | AOS-8 | Buffer overflow/RCE | Remote | 9.8 Critical |
| CVE-2026-79860 | AOS-8 | PAPI UDP/8211 buffer overflow/RCE | Remote | 9.8 Critical |
| CVE-2026-79861 | AOS-10 | PAPI command injection/RCE | Remote | 9.8 Critical |
| CVE-2026-79862 | AOS-8 & AOS-10 | Buffer overflow/RCE | Adjacent | 9.6 Critical |
| CVE-2026-79863 | AOS-8 & AOS-10 | Buffer overflow/RCE | Adjacent | 9.6 Critical |
| CVE-2026-79864 | AOS-10 | Command injection/RCE | Adjacent | 9.6 Critical |
| CVE-2026-79865 | AOS-10 | Memory corruption/RCE | Adjacent | 9.6 Critical |
| CVE-2026-79866 | AOS-8 | PAPI path traversal/filesystem compromise | Adjacent | 9.6 Critical |
| CVE-2026-79867 | AOS-8 | Authentication bypass/RCE | Adjacent | 9.6 Critical |
| CVE-2026-79868 | AOS-8 | Authentication bypass/complete compromise | Adjacent | 9.6 Critical |
| CVE-2026-79869 | AOS-10 | Authentication bypass/RCE | Adjacent | 9.6 Critical |
| CVE-2026-79870 | AOS-8 | PAPI authentication bypass/admin access | Adjacent | 9.6 Critical |
| CVE-2026-79871 | AOS-10 | CLI sensitive-information disclosure | Adjacent | 9.6 Critical |
| CVE-2026-79872 | AOS-8 & AOS-10 | OS buffer overflow/RCE | Remote | 9.4 Critical |
| CVE-2026-79873 | AOS-10 | PAPI authentication bypass/admin access | Adjacent | 9.3 Critical |
| CVE-2026-79874 | AOS-10 | API authentication bypass/admin access | Adjacent | 9.3 Critical |
| CVE-2026-79875 | AOS-8 | PAPI authentication bypass/admin access | Adjacent | 9.3 Critical |
| CVE-2026-79876 | AOS-10 | Wi-Fi frame information disclosure | Adjacent | 9.3 Critical |
| CVE-2026-79877 | AOS-10 | Underlying OS RCE | Adjacent | 8.8 High |
| CVE-2026-79878 | AOS-8 | PAPI command injection/RCE | Adjacent | 8.8 High |
| CVE-2026-79879 | AOS-10 | Memory corruption/RCE | Adjacent | 8.8 High |
| CVE-2026-79880 | AOS-8 | Server-side request forgery/RCE | Remote | 8.7 High |
| CVE-2026-79881 | AOS-8 | OS authentication bypass/complete compromise | Adjacent | 9.6 Critical |
| CVE-2026-79882 | AOS-10 | PAPI command injection/RCE | Adjacent | 8.3 High |
| CVE-2026-79883 | AOS-10 | PAPI buffer overflow/data disclosure/DoS | Adjacent | 8.3 High |
| CVE-2026-79884 | AOS-8 | Authentication bypass/information disclosure | Adjacent | 8.2 High |
| CVE-2026-79885 | AOS-8 | PAPI arbitrary file write/DoS | Remote | 8.2 High |
| CVE-2026-79886 | AOS-8 | PAPI buffer overflow/DoS | Remote | 8.2 High |
| CVE-2026-79887 | AOS-8 | Web-interface authentication bypass/RCE | Remote | 8.1 High |
| CVE-2026-79888 | AOS-8 | Buffer overflow/RCE | Remote | 8.1 High |
| CVE-2026-79889 | AOS-8 | Web-interface buffer overflows/RCE | Remote | 8.1 High |
| CVE-2026-79890 | AOS-8 | PAPI command injection/RCE | Remote | 8.1 High |
| CVE-2026-79891 | AOS-8 | CLI buffer overflow/RCE | Remote | 8.1 High |
| CVE-2026-79892 | AOS-8 | Local memory corruption/code execution | Local | 7.8 High |
| CVE-2026-79893 | AOS-10 | Memory corruption/DoS | Remote | 7.5 High |
| CVE-2026-79894 | AOS-8 | PAPI denial of service | Remote | 7.5 High |
| CVE-2026-79895 | AOS-10 | Denial of service | Remote | 7.5 High |
| CVE-2026-79955 | AOS-8 | PAPI memory corruption/DoS | Remote | 7.5 High |
| CVE-2026-79956 | AOS-8 | CLI command execution | Remote | 7.2 High |
| CVE-2026-95704 | AOS-8 & AOS-10 | Wireless-management interface RCE | Remote | 7.2 Medium |
| CVE-2026-95705 | AOS-8 | Command injection | Remote | 7.2 High |
| CVE-2026-95706 | AOS-8 | Command injection | Remote | 7.2 High |
| CVE-2026-95707 | AOS-8 | PAPI buffer overflow/RCE | Remote | 7.2 High |
| CVE-2026-95708 | AOS-10 | Command injection/RCE | Remote | 7.2 High |
| CVE-2026-95709 | AOS-10 | Command injection/RCE | Remote | 7.2 High |
| CVE-2026-95710 | AOS-8 & AOS-10 | Buffer overflow/DoS | Adjacent | 7.1 High |
| CVE-2026-95711 | AOS-10 | Web-management authentication bypass/RCE | Adjacent | 7.1 High |
| CVE-2026-95712 | AOS-8 | PAPI information disclosure/DoS | Adjacent | 7.1 High |
| CVE-2026-95713 | AOS-8 | CLI buffer overflow/DoS | Remote | 7.0 High |
| CVE-2026-95714 | AOS-10 | API buffer overflow/RCE | Adjacent | 6.8 Medium |
| CVE-2026-95715 | AOS-10 | CLI command injection/complete compromise | Physical | 6.8 Medium |
| CVE-2026-95716 | AOS-10 | PAPI authentication bypass/configuration change | Adjacent | 6.5 Medium |
| CVE-2026-95717 | AOS-8 & AOS-10 | Stored cross-site scripting | Remote | 5.5 Medium |
| CVE-2026-95718 | AOS-8 | PAPI authentication bypass/settings modification | Remote | 5.3 Medium |
| CVE-2026-95719 | AOS-10 | Arbitrary file deletion/DoS | Remote | 4.9 Medium |
| CVE-2026-95720 | AOS-8 | Local buffer overflow/DoS | Local | 4.4 Medium |
| CVE-2026-95721 | AOS-8 | Web-management memory corruption/disclosure | Local | 3.3 Low |
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
WhatsApp and Telegram users in India may face access restrictions starting January 1, 2027, as…
StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted…
A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could…
Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. An unauthorized…
Quest Diagnostics disclosed unauthorized access to its Quanum LSM system, confirming that an unidentified party…
U.S. banks face challenges as third-party artificial intelligence agents detect unauthorized access to customer accounts.…