---
id: CVE-2026-79956
title: Improper Sanitization leads to Command Injection in AOS-8 Web Interface
summary: >-
  A vulnerability in the CLI command handling of the AOS-8 web interface could
  allow an authenticated remote attacker to execute arbitrary commands on the
  underlying operating system. Successful exploitation could allow an attacker
  to run …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-23T17:36:53.001520Z'
published: '2026-10-22'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T03:55:35.569Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79956'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00704
epssPercentile: 0.53126
ingestedAt: '2026-10-22T22:00:50.387Z'
---

## Overview

A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.

## Affected

- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.