Critical severity · published Oct 22, 2026
CVE-2026-79871
Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10
New
9.6
CVSS
0.3%
EPSS
No
On KEV
Description
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
ArubaOS (AOS) · Hewlett Packard Enterprise (HPE)
10.8.0.0 through 10.8.1.1; 10.7.0.0 through 10.7.2.6; 10.4.0.0 through 10.4.1.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-79871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-79871
support.hpe.com
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
More from ArubaOS (AOS)
10.0
CVE-2026-79851
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
10.0
CVE-2026-79850
Authentication Bypass Leading to Remote Code Execution in AOS-8
10.0
CVE-2026-79849
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
10.0
CVE-2026-79848
Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
10.0
CVE-2026-79847
Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10