{"schema_version":"2","view":"grouped","data":[{"id":56266,"cve_ids":["CVE-2026-79857"],"payload":{"kind":"advisory","title":"Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol","summary":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79857","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79857","aliases":["CVE-2026-79857"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:58.427Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79857","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:58.427Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:58.387Z"}}},"related_cves":[{"value":"CVE-2026-79857","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5be1c0d3-5ede-4f2d-8785-f350caf309a1","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79857","advisory_id":"5be1c0d3-5ede-4f2d-8785-f350caf309a1","event_types":["advisory"],"published_at":"2026-10-25T16:11:20.91912+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:06.618+00:00","detail_url":"/advisories/advisory%3A5be1c0d3-5ede-4f2d-8785-f350caf309a1","group":{"id":"advisory:5be1c0d3-5ede-4f2d-8785-f350caf309a1","revision":1,"primary_event_id":55790,"change":"published","superseded_by":[],"changed":{"id":55790,"cve_ids":["CVE-2026-79857"],"payload":{"kind":"advisory","title":"Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol","summary":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79857","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79857","aliases":["CVE-2026-79857"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:58.427Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79857","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:58.427Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:58.387Z"}}},"related_cves":[{"value":"CVE-2026-79857","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5be1c0d3-5ede-4f2d-8785-f350caf309a1","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79857","advisory_id":"5be1c0d3-5ede-4f2d-8785-f350caf309a1","event_types":["advisory"],"published_at":"2026-10-25T16:11:20.91912+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:06.618+00:00","detail_url":"/events/55790"},"members":[{"id":55790,"cve_ids":["CVE-2026-79857"],"payload":{"kind":"advisory","title":"Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol","summary":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79857","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79857","aliases":["CVE-2026-79857"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:58.427Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79857","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:58.427Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:58.387Z"}}},"related_cves":[{"value":"CVE-2026-79857","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5be1c0d3-5ede-4f2d-8785-f350caf309a1","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79857","advisory_id":"5be1c0d3-5ede-4f2d-8785-f350caf309a1","event_types":["advisory"],"published_at":"2026-10-25T16:11:20.91912+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:06.618+00:00","detail_url":"/events/55790"}]}},{"id":56265,"cve_ids":["CVE-2026-79856"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8","summary":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","evidence":"cve:CVE-2026-79856","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79856","aliases":["CVE-2026-79856"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:57.628Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79856","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:57.628Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:56.864Z"}}},"related_cves":[{"value":"CVE-2026-79856","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:07e295bb-1922-4911-9ba1-b27f6d191758","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79856","advisory_id":"07e295bb-1922-4911-9ba1-b27f6d191758","event_types":["advisory"],"published_at":"2026-10-25T16:11:20.258739+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:05.25+00:00","detail_url":"/advisories/advisory%3A07e295bb-1922-4911-9ba1-b27f6d191758","group":{"id":"advisory:07e295bb-1922-4911-9ba1-b27f6d191758","revision":1,"primary_event_id":55789,"change":"published","superseded_by":[],"changed":{"id":55789,"cve_ids":["CVE-2026-79856"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8","summary":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","evidence":"cve:CVE-2026-79856","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79856","aliases":["CVE-2026-79856"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:57.628Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79856","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:57.628Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:56.864Z"}}},"related_cves":[{"value":"CVE-2026-79856","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:07e295bb-1922-4911-9ba1-b27f6d191758","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79856","advisory_id":"07e295bb-1922-4911-9ba1-b27f6d191758","event_types":["advisory"],"published_at":"2026-10-25T16:11:20.258739+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:05.25+00:00","detail_url":"/events/55789"},"members":[{"id":55789,"cve_ids":["CVE-2026-79856"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8","summary":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","evidence":"cve:CVE-2026-79856","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79856","aliases":["CVE-2026-79856"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:57.628Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79856","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:57.628Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:56.864Z"}}},"related_cves":[{"value":"CVE-2026-79856","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:07e295bb-1922-4911-9ba1-b27f6d191758","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79856","advisory_id":"07e295bb-1922-4911-9ba1-b27f6d191758","event_types":["advisory"],"published_at":"2026-10-25T16:11:20.258739+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:05.25+00:00","detail_url":"/events/55789"}]}},{"id":56264,"cve_ids":["CVE-2026-79855"],"payload":{"kind":"advisory","title":"Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise","summary":"An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.","evidence":"cve:CVE-2026-79855","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79855","aliases":["CVE-2026-79855"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:56.822Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79855","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:56.822Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:55.554Z"}}},"related_cves":[{"value":"CVE-2026-79855","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:17458079-4248-4087-9a1a-8498c8e263f5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79855","advisory_id":"17458079-4248-4087-9a1a-8498c8e263f5","event_types":["advisory"],"published_at":"2026-10-25T16:11:19.61797+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:03.382+00:00","detail_url":"/advisories/advisory%3A17458079-4248-4087-9a1a-8498c8e263f5","group":{"id":"advisory:17458079-4248-4087-9a1a-8498c8e263f5","revision":1,"primary_event_id":55788,"change":"published","superseded_by":[],"changed":{"id":55788,"cve_ids":["CVE-2026-79855"],"payload":{"kind":"advisory","title":"Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise","summary":"An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.","evidence":"cve:CVE-2026-79855","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79855","aliases":["CVE-2026-79855"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:56.822Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79855","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:56.822Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:55.554Z"}}},"related_cves":[{"value":"CVE-2026-79855","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:17458079-4248-4087-9a1a-8498c8e263f5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79855","advisory_id":"17458079-4248-4087-9a1a-8498c8e263f5","event_types":["advisory"],"published_at":"2026-10-25T16:11:19.61797+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:03.382+00:00","detail_url":"/events/55788"},"members":[{"id":55788,"cve_ids":["CVE-2026-79855"],"payload":{"kind":"advisory","title":"Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise","summary":"An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.","evidence":"cve:CVE-2026-79855","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79855","aliases":["CVE-2026-79855"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:56.822Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79855","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-288","description":"CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:56.822Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:55.554Z"}}},"related_cves":[{"value":"CVE-2026-79855","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:17458079-4248-4087-9a1a-8498c8e263f5","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79855","advisory_id":"17458079-4248-4087-9a1a-8498c8e263f5","event_types":["advisory"],"published_at":"2026-10-25T16:11:19.61797+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:03.382+00:00","detail_url":"/events/55788"}]}},{"id":56263,"cve_ids":["CVE-2026-95711"],"payload":{"kind":"advisory","title":"Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface","summary":"An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-95711","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95711","aliases":["CVE-2026-95711"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:25.688Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95711","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:25.688Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:11.097Z"}}},"related_cves":[{"value":"CVE-2026-95711","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:43c5ec53-2f17-45a1-b282-3fc7b1840877","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95711","advisory_id":"43c5ec53-2f17-45a1-b282-3fc7b1840877","event_types":["advisory"],"published_at":"2026-10-25T16:11:18.955738+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:00.061+00:00","detail_url":"/advisories/advisory%3A43c5ec53-2f17-45a1-b282-3fc7b1840877","group":{"id":"advisory:43c5ec53-2f17-45a1-b282-3fc7b1840877","revision":1,"primary_event_id":55787,"change":"published","superseded_by":[],"changed":{"id":55787,"cve_ids":["CVE-2026-95711"],"payload":{"kind":"advisory","title":"Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface","summary":"An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-95711","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95711","aliases":["CVE-2026-95711"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:25.688Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95711","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:25.688Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:11.097Z"}}},"related_cves":[{"value":"CVE-2026-95711","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:43c5ec53-2f17-45a1-b282-3fc7b1840877","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95711","advisory_id":"43c5ec53-2f17-45a1-b282-3fc7b1840877","event_types":["advisory"],"published_at":"2026-10-25T16:11:18.955738+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:00.061+00:00","detail_url":"/events/55787"},"members":[{"id":55787,"cve_ids":["CVE-2026-95711"],"payload":{"kind":"advisory","title":"Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface","summary":"An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-95711","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95711","aliases":["CVE-2026-95711"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:25.688Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95711","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:25.688Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:11.097Z"}}},"related_cves":[{"value":"CVE-2026-95711","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:43c5ec53-2f17-45a1-b282-3fc7b1840877","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95711","advisory_id":"43c5ec53-2f17-45a1-b282-3fc7b1840877","event_types":["advisory"],"published_at":"2026-10-25T16:11:18.955738+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:00.061+00:00","detail_url":"/events/55787"}]}},{"id":56262,"cve_ids":["CVE-2026-79854"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10","summary":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-79854","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79854","aliases":["CVE-2026-79854"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:56.047Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79854","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:56.047Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:54.200Z"}}},"related_cves":[{"value":"CVE-2026-79854","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3d4b1803-81c8-4be5-8925-4e60d2a14e6d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79854","advisory_id":"3d4b1803-81c8-4be5-8925-4e60d2a14e6d","event_types":["advisory"],"published_at":"2026-10-25T16:11:18.20636+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:02.138+00:00","detail_url":"/advisories/advisory%3A3d4b1803-81c8-4be5-8925-4e60d2a14e6d","group":{"id":"advisory:3d4b1803-81c8-4be5-8925-4e60d2a14e6d","revision":1,"primary_event_id":55786,"change":"published","superseded_by":[],"changed":{"id":55786,"cve_ids":["CVE-2026-79854"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10","summary":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-79854","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79854","aliases":["CVE-2026-79854"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:56.047Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79854","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:56.047Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:54.200Z"}}},"related_cves":[{"value":"CVE-2026-79854","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3d4b1803-81c8-4be5-8925-4e60d2a14e6d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79854","advisory_id":"3d4b1803-81c8-4be5-8925-4e60d2a14e6d","event_types":["advisory"],"published_at":"2026-10-25T16:11:18.20636+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:02.138+00:00","detail_url":"/events/55786"},"members":[{"id":55786,"cve_ids":["CVE-2026-79854"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10","summary":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-79854","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79854","aliases":["CVE-2026-79854"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:56.047Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79854","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:56.047Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:54.200Z"}}},"related_cves":[{"value":"CVE-2026-79854","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3d4b1803-81c8-4be5-8925-4e60d2a14e6d","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79854","advisory_id":"3d4b1803-81c8-4be5-8925-4e60d2a14e6d","event_types":["advisory"],"published_at":"2026-10-25T16:11:18.20636+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:02.138+00:00","detail_url":"/events/55786"}]}},{"id":56261,"cve_ids":["CVE-2026-95714"],"payload":{"kind":"advisory","title":"Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10","summary":"A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95714","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95714","aliases":["CVE-2026-95714"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:24.769Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95714","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:24.769Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:15.157Z"}}},"related_cves":[{"value":"CVE-2026-95714","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6f2e665a-4087-4394-b03d-ff3780f97b0e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95714","advisory_id":"6f2e665a-4087-4394-b03d-ff3780f97b0e","event_types":["advisory"],"published_at":"2026-10-25T16:11:17.539143+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:03.957+00:00","detail_url":"/advisories/advisory%3A6f2e665a-4087-4394-b03d-ff3780f97b0e","group":{"id":"advisory:6f2e665a-4087-4394-b03d-ff3780f97b0e","revision":1,"primary_event_id":55785,"change":"published","superseded_by":[],"changed":{"id":55785,"cve_ids":["CVE-2026-95714"],"payload":{"kind":"advisory","title":"Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10","summary":"A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95714","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95714","aliases":["CVE-2026-95714"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:24.769Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95714","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:24.769Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:15.157Z"}}},"related_cves":[{"value":"CVE-2026-95714","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6f2e665a-4087-4394-b03d-ff3780f97b0e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95714","advisory_id":"6f2e665a-4087-4394-b03d-ff3780f97b0e","event_types":["advisory"],"published_at":"2026-10-25T16:11:17.539143+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:03.957+00:00","detail_url":"/events/55785"},"members":[{"id":55785,"cve_ids":["CVE-2026-95714"],"payload":{"kind":"advisory","title":"Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10","summary":"A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95714","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95714","aliases":["CVE-2026-95714"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:24.769Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95714","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:24.769Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:15.157Z"}}},"related_cves":[{"value":"CVE-2026-95714","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6f2e665a-4087-4394-b03d-ff3780f97b0e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95714","advisory_id":"6f2e665a-4087-4394-b03d-ff3780f97b0e","event_types":["advisory"],"published_at":"2026-10-25T16:11:17.539143+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:03.957+00:00","detail_url":"/events/55785"}]}},{"id":56260,"cve_ids":["CVE-2026-95709"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-10","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95709","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95709","aliases":["CVE-2026-95709"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:26.505Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95709","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:26.505Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:08.478Z"}}},"related_cves":[{"value":"CVE-2026-95709","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95709","advisory_id":"646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","event_types":["advisory"],"published_at":"2026-10-25T16:11:16.862342+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:56.95+00:00","detail_url":"/advisories/advisory%3A646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","group":{"id":"advisory:646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","revision":1,"primary_event_id":55784,"change":"published","superseded_by":[],"changed":{"id":55784,"cve_ids":["CVE-2026-95709"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-10","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95709","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95709","aliases":["CVE-2026-95709"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:26.505Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95709","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:26.505Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:08.478Z"}}},"related_cves":[{"value":"CVE-2026-95709","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95709","advisory_id":"646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","event_types":["advisory"],"published_at":"2026-10-25T16:11:16.862342+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:56.95+00:00","detail_url":"/events/55784"},"members":[{"id":55784,"cve_ids":["CVE-2026-95709"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-10","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95709","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95709","aliases":["CVE-2026-95709"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:26.505Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95709","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:26.505Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:08.478Z"}}},"related_cves":[{"value":"CVE-2026-95709","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95709","advisory_id":"646fdbfa-e2f6-43aa-a611-c22b2c3b2fb0","event_types":["advisory"],"published_at":"2026-10-25T16:11:16.862342+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:56.95+00:00","detail_url":"/events/55784"}]}},{"id":56259,"cve_ids":["CVE-2026-95708"],"payload":{"kind":"advisory","title":"Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95708","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95708","aliases":["CVE-2026-95708"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:27.323Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95708","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:27.323Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:07.149Z"}}},"related_cves":[{"value":"CVE-2026-95708","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8a5967f9-c926-46d1-a6c4-9b447b267bba","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95708","advisory_id":"8a5967f9-c926-46d1-a6c4-9b447b267bba","event_types":["advisory"],"published_at":"2026-10-25T16:11:16.204379+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:55.736+00:00","detail_url":"/advisories/advisory%3A8a5967f9-c926-46d1-a6c4-9b447b267bba","group":{"id":"advisory:8a5967f9-c926-46d1-a6c4-9b447b267bba","revision":1,"primary_event_id":55783,"change":"published","superseded_by":[],"changed":{"id":55783,"cve_ids":["CVE-2026-95708"],"payload":{"kind":"advisory","title":"Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95708","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95708","aliases":["CVE-2026-95708"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:27.323Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95708","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:27.323Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:07.149Z"}}},"related_cves":[{"value":"CVE-2026-95708","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8a5967f9-c926-46d1-a6c4-9b447b267bba","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95708","advisory_id":"8a5967f9-c926-46d1-a6c4-9b447b267bba","event_types":["advisory"],"published_at":"2026-10-25T16:11:16.204379+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:55.736+00:00","detail_url":"/events/55783"},"members":[{"id":55783,"cve_ids":["CVE-2026-95708"],"payload":{"kind":"advisory","title":"Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10","summary":"Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95708","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95708","aliases":["CVE-2026-95708"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:27.323Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95708","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:27.323Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:07.149Z"}}},"related_cves":[{"value":"CVE-2026-95708","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8a5967f9-c926-46d1-a6c4-9b447b267bba","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95708","advisory_id":"8a5967f9-c926-46d1-a6c4-9b447b267bba","event_types":["advisory"],"published_at":"2026-10-25T16:11:16.204379+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:55.736+00:00","detail_url":"/events/55783"}]}},{"id":56258,"cve_ids":["CVE-2026-95707"],"payload":{"kind":"advisory","title":"Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","summary":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95707","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95707","aliases":["CVE-2026-95707"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:29.047Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95707","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:29.047Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:05.739Z"}}},"related_cves":[{"value":"CVE-2026-95707","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7cfb372d-8901-4e93-9290-64815e7f6dd5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95707","advisory_id":"7cfb372d-8901-4e93-9290-64815e7f6dd5","event_types":["advisory"],"published_at":"2026-10-25T16:11:15.557579+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:54.542+00:00","detail_url":"/advisories/advisory%3A7cfb372d-8901-4e93-9290-64815e7f6dd5","group":{"id":"advisory:7cfb372d-8901-4e93-9290-64815e7f6dd5","revision":1,"primary_event_id":55782,"change":"published","superseded_by":[],"changed":{"id":55782,"cve_ids":["CVE-2026-95707"],"payload":{"kind":"advisory","title":"Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","summary":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95707","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95707","aliases":["CVE-2026-95707"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:29.047Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95707","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:29.047Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:05.739Z"}}},"related_cves":[{"value":"CVE-2026-95707","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7cfb372d-8901-4e93-9290-64815e7f6dd5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95707","advisory_id":"7cfb372d-8901-4e93-9290-64815e7f6dd5","event_types":["advisory"],"published_at":"2026-10-25T16:11:15.557579+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:54.542+00:00","detail_url":"/events/55782"},"members":[{"id":55782,"cve_ids":["CVE-2026-95707"],"payload":{"kind":"advisory","title":"Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","summary":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-95707","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95707","aliases":["CVE-2026-95707"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:29.047Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95707","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:29.047Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:05.739Z"}}},"related_cves":[{"value":"CVE-2026-95707","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7cfb372d-8901-4e93-9290-64815e7f6dd5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95707","advisory_id":"7cfb372d-8901-4e93-9290-64815e7f6dd5","event_types":["advisory"],"published_at":"2026-10-25T16:11:15.557579+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:54.542+00:00","detail_url":"/events/55782"}]}},{"id":56257,"cve_ids":["CVE-2026-95706"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-8","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","evidence":"cve:CVE-2026-95706","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95706","aliases":["CVE-2026-95706"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:32.247Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95706","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:32.247Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:04.477Z"}}},"related_cves":[{"value":"CVE-2026-95706","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95706","advisory_id":"1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","event_types":["advisory"],"published_at":"2026-10-25T16:11:14.867519+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:53.378+00:00","detail_url":"/advisories/advisory%3A1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","group":{"id":"advisory:1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","revision":1,"primary_event_id":55781,"change":"published","superseded_by":[],"changed":{"id":55781,"cve_ids":["CVE-2026-95706"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-8","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","evidence":"cve:CVE-2026-95706","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95706","aliases":["CVE-2026-95706"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:32.247Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95706","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:32.247Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:04.477Z"}}},"related_cves":[{"value":"CVE-2026-95706","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95706","advisory_id":"1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","event_types":["advisory"],"published_at":"2026-10-25T16:11:14.867519+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:53.378+00:00","detail_url":"/events/55781"},"members":[{"id":55781,"cve_ids":["CVE-2026-95706"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-8","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","evidence":"cve:CVE-2026-95706","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95706","aliases":["CVE-2026-95706"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:32.247Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95706","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:32.247Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:04.477Z"}}},"related_cves":[{"value":"CVE-2026-95706","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95706","advisory_id":"1d2fe857-6d37-4978-9b62-6fd5f79fb5b3","event_types":["advisory"],"published_at":"2026-10-25T16:11:14.867519+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:53.378+00:00","detail_url":"/events/55781"}]}},{"id":56256,"cve_ids":["CVE-2026-95705"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-8","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","evidence":"cve:CVE-2026-95705","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95705","aliases":["CVE-2026-95705"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:33.153Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95705","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:33.153Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:03.133Z"}}},"related_cves":[{"value":"CVE-2026-95705","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dbcb87a8-7320-498f-a2f4-c504933ae7cb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95705","advisory_id":"dbcb87a8-7320-498f-a2f4-c504933ae7cb","event_types":["advisory"],"published_at":"2026-10-25T16:11:14.201237+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:52.111+00:00","detail_url":"/advisories/advisory%3Adbcb87a8-7320-498f-a2f4-c504933ae7cb","group":{"id":"advisory:dbcb87a8-7320-498f-a2f4-c504933ae7cb","revision":1,"primary_event_id":55780,"change":"published","superseded_by":[],"changed":{"id":55780,"cve_ids":["CVE-2026-95705"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-8","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","evidence":"cve:CVE-2026-95705","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95705","aliases":["CVE-2026-95705"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:33.153Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95705","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:33.153Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:03.133Z"}}},"related_cves":[{"value":"CVE-2026-95705","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dbcb87a8-7320-498f-a2f4-c504933ae7cb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95705","advisory_id":"dbcb87a8-7320-498f-a2f4-c504933ae7cb","event_types":["advisory"],"published_at":"2026-10-25T16:11:14.201237+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:52.111+00:00","detail_url":"/events/55780"},"members":[{"id":55780,"cve_ids":["CVE-2026-95705"],"payload":{"kind":"advisory","title":"Authenticated Command Injection Vulnerabilities in AOS-8","summary":"Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.","evidence":"cve:CVE-2026-95705","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95705","aliases":["CVE-2026-95705"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:33.153Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95705","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:33.153Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:03.133Z"}}},"related_cves":[{"value":"CVE-2026-95705","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:dbcb87a8-7320-498f-a2f4-c504933ae7cb","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95705","advisory_id":"dbcb87a8-7320-498f-a2f4-c504933ae7cb","event_types":["advisory"],"published_at":"2026-10-25T16:11:14.201237+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:52.111+00:00","detail_url":"/events/55780"}]}},{"id":56255,"cve_ids":["CVE-2026-95704"],"payload":{"kind":"advisory","title":"Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface","summary":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.","evidence":"cve:CVE-2026-95704","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95704","aliases":["CVE-2026-95704"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:34.687Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95704","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-284","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:34.687Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:01.853Z"}}},"related_cves":[{"value":"CVE-2026-95704","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95704","advisory_id":"f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","event_types":["advisory"],"published_at":"2026-10-25T16:11:13.542023+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:50.866+00:00","detail_url":"/advisories/advisory%3Af9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","group":{"id":"advisory:f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","revision":1,"primary_event_id":55779,"change":"published","superseded_by":[],"changed":{"id":55779,"cve_ids":["CVE-2026-95704"],"payload":{"kind":"advisory","title":"Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface","summary":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.","evidence":"cve:CVE-2026-95704","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95704","aliases":["CVE-2026-95704"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:34.687Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95704","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-284","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:34.687Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:01.853Z"}}},"related_cves":[{"value":"CVE-2026-95704","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95704","advisory_id":"f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","event_types":["advisory"],"published_at":"2026-10-25T16:11:13.542023+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:50.866+00:00","detail_url":"/events/55779"},"members":[{"id":55779,"cve_ids":["CVE-2026-95704"],"payload":{"kind":"advisory","title":"Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface","summary":"A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.","evidence":"cve:CVE-2026-95704","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95704","aliases":["CVE-2026-95704"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:34.687Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95704","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-284","description":"CWE-284 Improper Access Control"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:34.687Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:01.853Z"}}},"related_cves":[{"value":"CVE-2026-95704","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95704","advisory_id":"f9cc7ec8-58fe-4a7d-80e1-47a45fbc5aaf","event_types":["advisory"],"published_at":"2026-10-25T16:11:13.542023+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:50.866+00:00","detail_url":"/events/55779"}]}},{"id":56254,"cve_ids":["CVE-2026-79956"],"payload":{"kind":"advisory","title":"Improper Sanitization leads to Command Injection in AOS-8 Web Interface","summary":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.","evidence":"cve:CVE-2026-79956","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79956","aliases":["CVE-2026-79956"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:35.569Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79956","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:35.569Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:00.458Z"}}},"related_cves":[{"value":"CVE-2026-79956","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:72896cf2-c8b2-4612-b140-3ab4e246e7a5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79956","advisory_id":"72896cf2-c8b2-4612-b140-3ab4e246e7a5","event_types":["advisory"],"published_at":"2026-10-25T16:11:12.879537+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:49.538+00:00","detail_url":"/advisories/advisory%3A72896cf2-c8b2-4612-b140-3ab4e246e7a5","group":{"id":"advisory:72896cf2-c8b2-4612-b140-3ab4e246e7a5","revision":1,"primary_event_id":55778,"change":"published","superseded_by":[],"changed":{"id":55778,"cve_ids":["CVE-2026-79956"],"payload":{"kind":"advisory","title":"Improper Sanitization leads to Command Injection in AOS-8 Web Interface","summary":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.","evidence":"cve:CVE-2026-79956","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79956","aliases":["CVE-2026-79956"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:35.569Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79956","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:35.569Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:00.458Z"}}},"related_cves":[{"value":"CVE-2026-79956","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:72896cf2-c8b2-4612-b140-3ab4e246e7a5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79956","advisory_id":"72896cf2-c8b2-4612-b140-3ab4e246e7a5","event_types":["advisory"],"published_at":"2026-10-25T16:11:12.879537+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:49.538+00:00","detail_url":"/events/55778"},"members":[{"id":55778,"cve_ids":["CVE-2026-79956"],"payload":{"kind":"advisory","title":"Improper Sanitization leads to Command Injection in AOS-8 Web Interface","summary":"A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.","evidence":"cve:CVE-2026-79956","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79956","aliases":["CVE-2026-79956"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:35.569Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79956","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:35.569Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:00.458Z"}}},"related_cves":[{"value":"CVE-2026-79956","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:72896cf2-c8b2-4612-b140-3ab4e246e7a5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79956","advisory_id":"72896cf2-c8b2-4612-b140-3ab4e246e7a5","event_types":["advisory"],"published_at":"2026-10-25T16:11:12.879537+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:49.538+00:00","detail_url":"/events/55778"}]}},{"id":56253,"cve_ids":["CVE-2026-79892"],"payload":{"kind":"advisory","title":"Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8","summary":"A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79892","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79892","aliases":["CVE-2026-79892"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:39.968Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79892","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:39.968Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:53.068Z"}}},"related_cves":[{"value":"CVE-2026-79892","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b44ab4fe-5017-4e59-a0b9-96738a40a007","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79892","advisory_id":"b44ab4fe-5017-4e59-a0b9-96738a40a007","event_types":["advisory"],"published_at":"2026-10-25T16:11:12.206547+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:38.055+00:00","detail_url":"/advisories/advisory%3Ab44ab4fe-5017-4e59-a0b9-96738a40a007","group":{"id":"advisory:b44ab4fe-5017-4e59-a0b9-96738a40a007","revision":1,"primary_event_id":55777,"change":"published","superseded_by":[],"changed":{"id":55777,"cve_ids":["CVE-2026-79892"],"payload":{"kind":"advisory","title":"Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8","summary":"A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79892","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79892","aliases":["CVE-2026-79892"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:39.968Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79892","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:39.968Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:53.068Z"}}},"related_cves":[{"value":"CVE-2026-79892","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b44ab4fe-5017-4e59-a0b9-96738a40a007","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79892","advisory_id":"b44ab4fe-5017-4e59-a0b9-96738a40a007","event_types":["advisory"],"published_at":"2026-10-25T16:11:12.206547+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:38.055+00:00","detail_url":"/events/55777"},"members":[{"id":55777,"cve_ids":["CVE-2026-79892"],"payload":{"kind":"advisory","title":"Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8","summary":"A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79892","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79892","aliases":["CVE-2026-79892"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:39.968Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79892","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:39.968Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:53.068Z"}}},"related_cves":[{"value":"CVE-2026-79892","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:b44ab4fe-5017-4e59-a0b9-96738a40a007","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79892","advisory_id":"b44ab4fe-5017-4e59-a0b9-96738a40a007","event_types":["advisory"],"published_at":"2026-10-25T16:11:12.206547+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:38.055+00:00","detail_url":"/events/55777"}]}},{"id":56252,"cve_ids":["CVE-2026-79891"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","summary":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","evidence":"cve:CVE-2026-79891","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79891","aliases":["CVE-2026-79891"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:40.806Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79891","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:40.806Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:50.558Z"}}},"related_cves":[{"value":"CVE-2026-79891","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c828205f-5001-4246-9694-7f07415e164d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79891","advisory_id":"c828205f-5001-4246-9694-7f07415e164d","event_types":["advisory"],"published_at":"2026-10-25T16:11:11.529218+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:26.615+00:00","detail_url":"/advisories/advisory%3Ac828205f-5001-4246-9694-7f07415e164d","group":{"id":"advisory:c828205f-5001-4246-9694-7f07415e164d","revision":1,"primary_event_id":55776,"change":"published","superseded_by":[],"changed":{"id":55776,"cve_ids":["CVE-2026-79891"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","summary":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","evidence":"cve:CVE-2026-79891","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79891","aliases":["CVE-2026-79891"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:40.806Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79891","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:40.806Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:50.558Z"}}},"related_cves":[{"value":"CVE-2026-79891","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c828205f-5001-4246-9694-7f07415e164d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79891","advisory_id":"c828205f-5001-4246-9694-7f07415e164d","event_types":["advisory"],"published_at":"2026-10-25T16:11:11.529218+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:26.615+00:00","detail_url":"/events/55776"},"members":[{"id":55776,"cve_ids":["CVE-2026-79891"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8","summary":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","evidence":"cve:CVE-2026-79891","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79891","aliases":["CVE-2026-79891"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:40.806Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79891","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:40.806Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:50.558Z"}}},"related_cves":[{"value":"CVE-2026-79891","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c828205f-5001-4246-9694-7f07415e164d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79891","advisory_id":"c828205f-5001-4246-9694-7f07415e164d","event_types":["advisory"],"published_at":"2026-10-25T16:11:11.529218+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:26.615+00:00","detail_url":"/events/55776"}]}},{"id":56251,"cve_ids":["CVE-2026-79890"],"payload":{"kind":"advisory","title":"Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol","summary":"There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79890","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79890","aliases":["CVE-2026-79890"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:51.228Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79890","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:51.228Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:49.186Z"}}},"related_cves":[{"value":"CVE-2026-79890","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79890","advisory_id":"3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","event_types":["advisory"],"published_at":"2026-10-25T16:11:10.867453+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:19.152+00:00","detail_url":"/advisories/advisory%3A3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","group":{"id":"advisory:3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","revision":1,"primary_event_id":55775,"change":"published","superseded_by":[],"changed":{"id":55775,"cve_ids":["CVE-2026-79890"],"payload":{"kind":"advisory","title":"Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol","summary":"There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79890","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79890","aliases":["CVE-2026-79890"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:51.228Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79890","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:51.228Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:49.186Z"}}},"related_cves":[{"value":"CVE-2026-79890","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79890","advisory_id":"3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","event_types":["advisory"],"published_at":"2026-10-25T16:11:10.867453+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:19.152+00:00","detail_url":"/events/55775"},"members":[{"id":55775,"cve_ids":["CVE-2026-79890"],"payload":{"kind":"advisory","title":"Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol","summary":"There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","evidence":"cve:CVE-2026-79890","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79890","aliases":["CVE-2026-79890"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:51.228Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79890","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:51.228Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:49.186Z"}}},"related_cves":[{"value":"CVE-2026-79890","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79890","advisory_id":"3599749e-ca3b-4bf5-9f86-e8b7184fd8cd","event_types":["advisory"],"published_at":"2026-10-25T16:11:10.867453+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:19.152+00:00","detail_url":"/events/55775"}]}},{"id":56250,"cve_ids":["CVE-2026-79889"],"payload":{"kind":"advisory","title":"Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution","summary":"Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","evidence":"cve:CVE-2026-79889","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79889","aliases":["CVE-2026-79889"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:53.621Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79889","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:53.621Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:42.828Z"}}},"related_cves":[{"value":"CVE-2026-79889","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3ec4b030-9aa6-47a8-8545-493da32e6bc9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79889","advisory_id":"3ec4b030-9aa6-47a8-8545-493da32e6bc9","event_types":["advisory"],"published_at":"2026-10-25T16:11:10.023031+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:17.875+00:00","detail_url":"/advisories/advisory%3A3ec4b030-9aa6-47a8-8545-493da32e6bc9","group":{"id":"advisory:3ec4b030-9aa6-47a8-8545-493da32e6bc9","revision":1,"primary_event_id":55774,"change":"published","superseded_by":[],"changed":{"id":55774,"cve_ids":["CVE-2026-79889"],"payload":{"kind":"advisory","title":"Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution","summary":"Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","evidence":"cve:CVE-2026-79889","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79889","aliases":["CVE-2026-79889"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:53.621Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79889","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:53.621Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:42.828Z"}}},"related_cves":[{"value":"CVE-2026-79889","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3ec4b030-9aa6-47a8-8545-493da32e6bc9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79889","advisory_id":"3ec4b030-9aa6-47a8-8545-493da32e6bc9","event_types":["advisory"],"published_at":"2026-10-25T16:11:10.023031+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:17.875+00:00","detail_url":"/events/55774"},"members":[{"id":55774,"cve_ids":["CVE-2026-79889"],"payload":{"kind":"advisory","title":"Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution","summary":"Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","evidence":"cve:CVE-2026-79889","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79889","aliases":["CVE-2026-79889"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:53.621Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79889","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:53.621Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:42.828Z"}}},"related_cves":[{"value":"CVE-2026-79889","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3ec4b030-9aa6-47a8-8545-493da32e6bc9","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79889","advisory_id":"3ec4b030-9aa6-47a8-8545-493da32e6bc9","event_types":["advisory"],"published_at":"2026-10-25T16:11:10.023031+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:17.875+00:00","detail_url":"/events/55774"}]}},{"id":56249,"cve_ids":["CVE-2026-79888"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow allows Remote Code Execution in web interface","summary":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","evidence":"cve:CVE-2026-79888","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79888","aliases":["CVE-2026-79888"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:54.447Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79888","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:54.447Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:41.479Z"}}},"related_cves":[{"value":"CVE-2026-79888","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9d8db9f7-e556-44fc-83f4-2e885b148a3c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79888","advisory_id":"9d8db9f7-e556-44fc-83f4-2e885b148a3c","event_types":["advisory"],"published_at":"2026-10-25T16:11:09.316955+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:16.674+00:00","detail_url":"/advisories/advisory%3A9d8db9f7-e556-44fc-83f4-2e885b148a3c","group":{"id":"advisory:9d8db9f7-e556-44fc-83f4-2e885b148a3c","revision":1,"primary_event_id":55773,"change":"published","superseded_by":[],"changed":{"id":55773,"cve_ids":["CVE-2026-79888"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow allows Remote Code Execution in web interface","summary":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","evidence":"cve:CVE-2026-79888","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79888","aliases":["CVE-2026-79888"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:54.447Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79888","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:54.447Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:41.479Z"}}},"related_cves":[{"value":"CVE-2026-79888","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9d8db9f7-e556-44fc-83f4-2e885b148a3c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79888","advisory_id":"9d8db9f7-e556-44fc-83f4-2e885b148a3c","event_types":["advisory"],"published_at":"2026-10-25T16:11:09.316955+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:16.674+00:00","detail_url":"/events/55773"},"members":[{"id":55773,"cve_ids":["CVE-2026-79888"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow allows Remote Code Execution in web interface","summary":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","evidence":"cve:CVE-2026-79888","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79888","aliases":["CVE-2026-79888"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:54.447Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79888","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:54.447Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:41.479Z"}}},"related_cves":[{"value":"CVE-2026-79888","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:9d8db9f7-e556-44fc-83f4-2e885b148a3c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79888","advisory_id":"9d8db9f7-e556-44fc-83f4-2e885b148a3c","event_types":["advisory"],"published_at":"2026-10-25T16:11:09.316955+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:16.674+00:00","detail_url":"/events/55773"}]}},{"id":56248,"cve_ids":["CVE-2026-79887"],"payload":{"kind":"advisory","title":"Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)","summary":"A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.","evidence":"cve:CVE-2026-79887","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79887","aliases":["CVE-2026-79887"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:55.267Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79887","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"},{"lang":"en","type":"CWE","cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:55.267Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:40.178Z"}}},"related_cves":[{"value":"CVE-2026-79887","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:94026198-7c4e-41de-ac66-fe1b5d4fc638","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79887","advisory_id":"94026198-7c4e-41de-ac66-fe1b5d4fc638","event_types":["advisory"],"published_at":"2026-10-25T16:11:08.46653+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:15.456+00:00","detail_url":"/advisories/advisory%3A94026198-7c4e-41de-ac66-fe1b5d4fc638","group":{"id":"advisory:94026198-7c4e-41de-ac66-fe1b5d4fc638","revision":1,"primary_event_id":55772,"change":"published","superseded_by":[],"changed":{"id":55772,"cve_ids":["CVE-2026-79887"],"payload":{"kind":"advisory","title":"Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)","summary":"A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.","evidence":"cve:CVE-2026-79887","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79887","aliases":["CVE-2026-79887"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:55.267Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79887","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"},{"lang":"en","type":"CWE","cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:55.267Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:40.178Z"}}},"related_cves":[{"value":"CVE-2026-79887","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:94026198-7c4e-41de-ac66-fe1b5d4fc638","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79887","advisory_id":"94026198-7c4e-41de-ac66-fe1b5d4fc638","event_types":["advisory"],"published_at":"2026-10-25T16:11:08.46653+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:15.456+00:00","detail_url":"/events/55772"},"members":[{"id":55772,"cve_ids":["CVE-2026-79887"],"payload":{"kind":"advisory","title":"Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)","summary":"A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.","evidence":"cve:CVE-2026-79887","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-79887","aliases":["CVE-2026-79887"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:55.267Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79887","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')"},{"lang":"en","type":"CWE","cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Function"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:55.267Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:13:40.178Z"}}},"related_cves":[{"value":"CVE-2026-79887","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:94026198-7c4e-41de-ac66-fe1b5d4fc638","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79887","advisory_id":"94026198-7c4e-41de-ac66-fe1b5d4fc638","event_types":["advisory"],"published_at":"2026-10-25T16:11:08.46653+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:06:15.456+00:00","detail_url":"/events/55772"}]}},{"id":56247,"cve_ids":["CVE-2026-79858"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8","summary":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.","evidence":"cve:CVE-2026-79858","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79858","aliases":["CVE-2026-79858"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:59.331Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79858","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:59.331Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:59.806Z"}}},"related_cves":[{"value":"CVE-2026-79858","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4ead518f-a36c-4161-b789-b8e23dcae827","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79858","advisory_id":"4ead518f-a36c-4161-b789-b8e23dcae827","event_types":["advisory"],"published_at":"2026-10-25T16:11:07.777216+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:08.166+00:00","detail_url":"/advisories/advisory%3A4ead518f-a36c-4161-b789-b8e23dcae827","group":{"id":"advisory:4ead518f-a36c-4161-b789-b8e23dcae827","revision":1,"primary_event_id":55771,"change":"published","superseded_by":[],"changed":{"id":55771,"cve_ids":["CVE-2026-79858"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8","summary":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.","evidence":"cve:CVE-2026-79858","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79858","aliases":["CVE-2026-79858"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:59.331Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79858","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:59.331Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:59.806Z"}}},"related_cves":[{"value":"CVE-2026-79858","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4ead518f-a36c-4161-b789-b8e23dcae827","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79858","advisory_id":"4ead518f-a36c-4161-b789-b8e23dcae827","event_types":["advisory"],"published_at":"2026-10-25T16:11:07.777216+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:08.166+00:00","detail_url":"/events/55771"},"members":[{"id":55771,"cve_ids":["CVE-2026-79858"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8","summary":"An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.","evidence":"cve:CVE-2026-79858","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79858","aliases":["CVE-2026-79858"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:59.331Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79858","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:59.331Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:59.806Z"}}},"related_cves":[{"value":"CVE-2026-79858","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4ead518f-a36c-4161-b789-b8e23dcae827","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79858","advisory_id":"4ead518f-a36c-4161-b789-b8e23dcae827","event_types":["advisory"],"published_at":"2026-10-25T16:11:07.777216+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:05:08.166+00:00","detail_url":"/events/55771"}]}},{"id":56246,"cve_ids":["CVE-2026-79852"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface","summary":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-79852","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79852","aliases":["CVE-2026-79852"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:22.585Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79852","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:22.585Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:51.587Z"}}},"related_cves":[{"value":"CVE-2026-79852","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02e0f229-bd00-40d8-9cc9-52fc20b59c79","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79852","advisory_id":"02e0f229-bd00-40d8-9cc9-52fc20b59c79","event_types":["advisory"],"published_at":"2026-10-25T16:11:07.040387+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:04:59.57+00:00","detail_url":"/advisories/advisory%3A02e0f229-bd00-40d8-9cc9-52fc20b59c79","group":{"id":"advisory:02e0f229-bd00-40d8-9cc9-52fc20b59c79","revision":1,"primary_event_id":55770,"change":"published","superseded_by":[],"changed":{"id":55770,"cve_ids":["CVE-2026-79852"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface","summary":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-79852","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79852","aliases":["CVE-2026-79852"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:22.585Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79852","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:22.585Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:51.587Z"}}},"related_cves":[{"value":"CVE-2026-79852","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02e0f229-bd00-40d8-9cc9-52fc20b59c79","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79852","advisory_id":"02e0f229-bd00-40d8-9cc9-52fc20b59c79","event_types":["advisory"],"published_at":"2026-10-25T16:11:07.040387+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:04:59.57+00:00","detail_url":"/events/55770"},"members":[{"id":55770,"cve_ids":["CVE-2026-79852"],"payload":{"kind":"advisory","title":"Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface","summary":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","evidence":"cve:CVE-2026-79852","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-79852","aliases":["CVE-2026-79852"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-24T03:55:22.585Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-79852","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-24T03:55:22.585Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:12:51.587Z"}}},"related_cves":[{"value":"CVE-2026-79852","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02e0f229-bd00-40d8-9cc9-52fc20b59c79","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-79852","advisory_id":"02e0f229-bd00-40d8-9cc9-52fc20b59c79","event_types":["advisory"],"published_at":"2026-10-25T16:11:07.040387+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:04:59.57+00:00","detail_url":"/events/55770"}]}},{"id":53628,"cve_ids":["CVE-2026-95721"],"payload":{"kind":"advisory","title":"Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface","summary":"A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service.","evidence":"cve:CVE-2026-95721","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-95721","aliases":["CVE-2026-95721"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:25.105Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95721","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:17:49.725365Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:17:53.964Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:25.105Z"}}},"related_cves":[{"value":"CVE-2026-95721","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5712bcf2-cfa5-477e-9323-9b356c72474c","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95721","advisory_id":"5712bcf2-cfa5-477e-9323-9b356c72474c","event_types":["advisory"],"published_at":"2026-10-25T14:57:23.579611+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:12.33+00:00","detail_url":"/advisories/advisory%3A5712bcf2-cfa5-477e-9323-9b356c72474c","group":{"id":"advisory:5712bcf2-cfa5-477e-9323-9b356c72474c","revision":1,"primary_event_id":53157,"change":"published","superseded_by":[],"changed":{"id":53157,"cve_ids":["CVE-2026-95721"],"payload":{"kind":"advisory","title":"Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface","summary":"A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service.","evidence":"cve:CVE-2026-95721","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-95721","aliases":["CVE-2026-95721"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:25.105Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95721","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:17:49.725365Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:17:53.964Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:25.105Z"}}},"related_cves":[{"value":"CVE-2026-95721","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5712bcf2-cfa5-477e-9323-9b356c72474c","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95721","advisory_id":"5712bcf2-cfa5-477e-9323-9b356c72474c","event_types":["advisory"],"published_at":"2026-10-25T14:57:23.579611+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:12.33+00:00","detail_url":"/events/53157"},"members":[{"id":53157,"cve_ids":["CVE-2026-95721"],"payload":{"kind":"advisory","title":"Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface","summary":"A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticated low privilege attacker with local access to view some system files and interrupt the normal operation of the affected service.","evidence":"cve:CVE-2026-95721","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-95721","aliases":["CVE-2026-95721"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":3.3,"attackVector":"LOCAL","baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:25.105Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95721","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:17:49.725365Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:17:53.964Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:25.105Z"}}},"related_cves":[{"value":"CVE-2026-95721","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5712bcf2-cfa5-477e-9323-9b356c72474c","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95721","advisory_id":"5712bcf2-cfa5-477e-9323-9b356c72474c","event_types":["advisory"],"published_at":"2026-10-25T14:57:23.579611+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:12.33+00:00","detail_url":"/events/53157"}]}},{"id":53627,"cve_ids":["CVE-2026-95720"],"payload":{"kind":"advisory","title":"Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8","summary":"A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.","evidence":"cve:CVE-2026-95720","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95720","aliases":["CVE-2026-95720"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:23.808Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95720","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:18:14.898524Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:18:30.252Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:23.808Z"}}},"related_cves":[{"value":"CVE-2026-95720","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:49f03f60-c659-4810-a4a5-94cdb4ee5467","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95720","advisory_id":"49f03f60-c659-4810-a4a5-94cdb4ee5467","event_types":["advisory"],"published_at":"2026-10-25T14:57:22.903025+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:11.179+00:00","detail_url":"/advisories/advisory%3A49f03f60-c659-4810-a4a5-94cdb4ee5467","group":{"id":"advisory:49f03f60-c659-4810-a4a5-94cdb4ee5467","revision":1,"primary_event_id":53156,"change":"published","superseded_by":[],"changed":{"id":53156,"cve_ids":["CVE-2026-95720"],"payload":{"kind":"advisory","title":"Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8","summary":"A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.","evidence":"cve:CVE-2026-95720","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95720","aliases":["CVE-2026-95720"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:23.808Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95720","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:18:14.898524Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:18:30.252Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:23.808Z"}}},"related_cves":[{"value":"CVE-2026-95720","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:49f03f60-c659-4810-a4a5-94cdb4ee5467","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95720","advisory_id":"49f03f60-c659-4810-a4a5-94cdb4ee5467","event_types":["advisory"],"published_at":"2026-10-25T14:57:22.903025+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:11.179+00:00","detail_url":"/events/53156"},"members":[{"id":53156,"cve_ids":["CVE-2026-95720"],"payload":{"kind":"advisory","title":"Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8","summary":"A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.","evidence":"cve:CVE-2026-95720","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95720","aliases":["CVE-2026-95720"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:23.808Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95720","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:18:14.898524Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:18:30.252Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:23.808Z"}}},"related_cves":[{"value":"CVE-2026-95720","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:49f03f60-c659-4810-a4a5-94cdb4ee5467","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95720","advisory_id":"49f03f60-c659-4810-a4a5-94cdb4ee5467","event_types":["advisory"],"published_at":"2026-10-25T14:57:22.903025+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:11.179+00:00","detail_url":"/events/53156"}]}},{"id":53626,"cve_ids":["CVE-2026-95719"],"payload":{"kind":"advisory","title":"Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10","summary":"An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting normal operation of the affected device.","evidence":"cve:CVE-2026-95719","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95719","aliases":["CVE-2026-95719"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:22.469Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95719","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:47:00.493529Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-266","description":"CWE-266 Incorrect Privilege Assignment"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:47:09.154Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:22.469Z"}}},"related_cves":[{"value":"CVE-2026-95719","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cad35218-b38b-4c0f-adbe-a86e3580eea5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95719","advisory_id":"cad35218-b38b-4c0f-adbe-a86e3580eea5","event_types":["advisory"],"published_at":"2026-10-25T14:57:22.259734+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:10.019+00:00","detail_url":"/advisories/advisory%3Acad35218-b38b-4c0f-adbe-a86e3580eea5","group":{"id":"advisory:cad35218-b38b-4c0f-adbe-a86e3580eea5","revision":1,"primary_event_id":53155,"change":"published","superseded_by":[],"changed":{"id":53155,"cve_ids":["CVE-2026-95719"],"payload":{"kind":"advisory","title":"Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10","summary":"An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting normal operation of the affected device.","evidence":"cve:CVE-2026-95719","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95719","aliases":["CVE-2026-95719"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:22.469Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95719","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:47:00.493529Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-266","description":"CWE-266 Incorrect Privilege Assignment"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:47:09.154Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:22.469Z"}}},"related_cves":[{"value":"CVE-2026-95719","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cad35218-b38b-4c0f-adbe-a86e3580eea5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95719","advisory_id":"cad35218-b38b-4c0f-adbe-a86e3580eea5","event_types":["advisory"],"published_at":"2026-10-25T14:57:22.259734+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:10.019+00:00","detail_url":"/events/53155"},"members":[{"id":53155,"cve_ids":["CVE-2026-95719"],"payload":{"kind":"advisory","title":"Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10","summary":"An arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting normal operation of the affected device.","evidence":"cve:CVE-2026-95719","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95719","aliases":["CVE-2026-95719"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:22.469Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95719","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:47:00.493529Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-266","description":"CWE-266 Incorrect Privilege Assignment"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:47:09.154Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:22.469Z"}}},"related_cves":[{"value":"CVE-2026-95719","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cad35218-b38b-4c0f-adbe-a86e3580eea5","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95719","advisory_id":"cad35218-b38b-4c0f-adbe-a86e3580eea5","event_types":["advisory"],"published_at":"2026-10-25T14:57:22.259734+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:10.019+00:00","detail_url":"/events/53155"}]}},{"id":53625,"cve_ids":["CVE-2026-95718"],"payload":{"kind":"advisory","title":"Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8","summary":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system.","evidence":"cve:CVE-2026-95718","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95718","aliases":["CVE-2026-95718"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:23:10.548Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T19:23:06.271882Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-287","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T19:23:10.548Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:21.183Z"}}},"related_cves":[{"value":"CVE-2026-95718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fdd5228f-86bd-4228-a696-8b528c3ea3e2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95718","advisory_id":"fdd5228f-86bd-4228-a696-8b528c3ea3e2","event_types":["advisory"],"published_at":"2026-10-25T14:57:21.391944+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:08.833+00:00","detail_url":"/advisories/advisory%3Afdd5228f-86bd-4228-a696-8b528c3ea3e2","group":{"id":"advisory:fdd5228f-86bd-4228-a696-8b528c3ea3e2","revision":1,"primary_event_id":53154,"change":"published","superseded_by":[],"changed":{"id":53154,"cve_ids":["CVE-2026-95718"],"payload":{"kind":"advisory","title":"Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8","summary":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system.","evidence":"cve:CVE-2026-95718","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95718","aliases":["CVE-2026-95718"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:23:10.548Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T19:23:06.271882Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-287","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T19:23:10.548Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:21.183Z"}}},"related_cves":[{"value":"CVE-2026-95718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fdd5228f-86bd-4228-a696-8b528c3ea3e2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95718","advisory_id":"fdd5228f-86bd-4228-a696-8b528c3ea3e2","event_types":["advisory"],"published_at":"2026-10-25T14:57:21.391944+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:08.833+00:00","detail_url":"/events/53154"},"members":[{"id":53154,"cve_ids":["CVE-2026-95718"],"payload":{"kind":"advisory","title":"Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8","summary":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to make limited unauthorized modifications to certain settings of the affected system.","evidence":"cve:CVE-2026-95718","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95718","aliases":["CVE-2026-95718"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:23:10.548Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95718","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T19:23:06.271882Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-287","description":"CWE-287 Improper Authentication"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T19:23:10.548Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:21.183Z"}}},"related_cves":[{"value":"CVE-2026-95718","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fdd5228f-86bd-4228-a696-8b528c3ea3e2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95718","advisory_id":"fdd5228f-86bd-4228-a696-8b528c3ea3e2","event_types":["advisory"],"published_at":"2026-10-25T14:57:21.391944+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:08.833+00:00","detail_url":"/events/53154"}]}},{"id":53624,"cve_ids":["CVE-2026-95717"],"payload":{"kind":"advisory","title":"Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface","summary":"A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session.","evidence":"cve:CVE-2026-95717","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95717","aliases":["CVE-2026-95717"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:19.329Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95717","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:51:55.622740Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:52:00.370Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:19.329Z"}}},"related_cves":[{"value":"CVE-2026-95717","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81eda8df-5ad6-4cb7-86ed-542931dbd10f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95717","advisory_id":"81eda8df-5ad6-4cb7-86ed-542931dbd10f","event_types":["advisory"],"published_at":"2026-10-25T14:57:20.386412+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:07.517+00:00","detail_url":"/advisories/advisory%3A81eda8df-5ad6-4cb7-86ed-542931dbd10f","group":{"id":"advisory:81eda8df-5ad6-4cb7-86ed-542931dbd10f","revision":1,"primary_event_id":53153,"change":"published","superseded_by":[],"changed":{"id":53153,"cve_ids":["CVE-2026-95717"],"payload":{"kind":"advisory","title":"Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface","summary":"A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session.","evidence":"cve:CVE-2026-95717","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95717","aliases":["CVE-2026-95717"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:19.329Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95717","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:51:55.622740Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:52:00.370Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:19.329Z"}}},"related_cves":[{"value":"CVE-2026-95717","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81eda8df-5ad6-4cb7-86ed-542931dbd10f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95717","advisory_id":"81eda8df-5ad6-4cb7-86ed-542931dbd10f","event_types":["advisory"],"published_at":"2026-10-25T14:57:20.386412+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:07.517+00:00","detail_url":"/events/53153"},"members":[{"id":53153,"cve_ids":["CVE-2026-95717"],"payload":{"kind":"advisory","title":"Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface","summary":"A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session.","evidence":"cve:CVE-2026-95717","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95717","aliases":["CVE-2026-95717"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"},{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:19.329Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95717","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:51:55.622740Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:52:00.370Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:19.329Z"}}},"related_cves":[{"value":"CVE-2026-95717","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81eda8df-5ad6-4cb7-86ed-542931dbd10f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95717","advisory_id":"81eda8df-5ad6-4cb7-86ed-542931dbd10f","event_types":["advisory"],"published_at":"2026-10-25T14:57:20.386412+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:07.517+00:00","detail_url":"/events/53153"}]}},{"id":53623,"cve_ids":["CVE-2026-95716"],"payload":{"kind":"advisory","title":"Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes","summary":"An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system.","evidence":"cve:CVE-2026-95716","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95716","aliases":["CVE-2026-95716"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:17.946Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95716","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:53:18.258596Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:53:24.553Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:17.946Z"}}},"related_cves":[{"value":"CVE-2026-95716","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1697b247-5cad-41ef-9517-aede4750830b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95716","advisory_id":"1697b247-5cad-41ef-9517-aede4750830b","event_types":["advisory"],"published_at":"2026-10-25T14:57:19.50843+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:06.333+00:00","detail_url":"/advisories/advisory%3A1697b247-5cad-41ef-9517-aede4750830b","group":{"id":"advisory:1697b247-5cad-41ef-9517-aede4750830b","revision":1,"primary_event_id":53152,"change":"published","superseded_by":[],"changed":{"id":53152,"cve_ids":["CVE-2026-95716"],"payload":{"kind":"advisory","title":"Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes","summary":"An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system.","evidence":"cve:CVE-2026-95716","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95716","aliases":["CVE-2026-95716"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:17.946Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95716","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:53:18.258596Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:53:24.553Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:17.946Z"}}},"related_cves":[{"value":"CVE-2026-95716","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1697b247-5cad-41ef-9517-aede4750830b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95716","advisory_id":"1697b247-5cad-41ef-9517-aede4750830b","event_types":["advisory"],"published_at":"2026-10-25T14:57:19.50843+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:06.333+00:00","detail_url":"/events/53152"},"members":[{"id":53152,"cve_ids":["CVE-2026-95716"],"payload":{"kind":"advisory","title":"Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes","summary":"An authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system.","evidence":"cve:CVE-2026-95716","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95716","aliases":["CVE-2026-95716"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"ADJACENT_NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:17.946Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95716","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:53:18.258596Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:53:24.553Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:17.946Z"}}},"related_cves":[{"value":"CVE-2026-95716","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1697b247-5cad-41ef-9517-aede4750830b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95716","advisory_id":"1697b247-5cad-41ef-9517-aede4750830b","event_types":["advisory"],"published_at":"2026-10-25T14:57:19.50843+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:06.333+00:00","detail_url":"/events/53152"}]}},{"id":53622,"cve_ids":["CVE-2026-95715"],"payload":{"kind":"advisory","title":"Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface","summary":"An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.","evidence":"cve:CVE-2026-95715","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95715","aliases":["CVE-2026-95715"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"PHYSICAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:16.580Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95715","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T15:54:01.952086Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:54:06.225Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:16.580Z"}}},"related_cves":[{"value":"CVE-2026-95715","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e7e2e3e3-8075-441a-b283-cc3b47801804","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95715","advisory_id":"e7e2e3e3-8075-441a-b283-cc3b47801804","event_types":["advisory"],"published_at":"2026-10-25T14:56:17.772442+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:05.183+00:00","detail_url":"/advisories/advisory%3Ae7e2e3e3-8075-441a-b283-cc3b47801804","group":{"id":"advisory:e7e2e3e3-8075-441a-b283-cc3b47801804","revision":1,"primary_event_id":53151,"change":"published","superseded_by":[],"changed":{"id":53151,"cve_ids":["CVE-2026-95715"],"payload":{"kind":"advisory","title":"Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface","summary":"An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.","evidence":"cve:CVE-2026-95715","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95715","aliases":["CVE-2026-95715"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"PHYSICAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:16.580Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95715","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T15:54:01.952086Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:54:06.225Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:16.580Z"}}},"related_cves":[{"value":"CVE-2026-95715","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e7e2e3e3-8075-441a-b283-cc3b47801804","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95715","advisory_id":"e7e2e3e3-8075-441a-b283-cc3b47801804","event_types":["advisory"],"published_at":"2026-10-25T14:56:17.772442+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:05.183+00:00","detail_url":"/events/53151"},"members":[{"id":53151,"cve_ids":["CVE-2026-95715"],"payload":{"kind":"advisory","title":"Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface","summary":"An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.","evidence":"cve:CVE-2026-95715","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-95715","aliases":["CVE-2026-95715"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"PHYSICAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"10.8.0.0","versionType":"semver","lessThanOrEqual":"10.8.1.1"},{"status":"affected","version":"10.7.0.0","versionType":"semver","lessThanOrEqual":"10.7.2.6"},{"status":"affected","version":"10.4.0.0","versionType":"semver","lessThanOrEqual":"10.4.1.13"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:16.580Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95715","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-23T15:54:01.952086Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:54:06.225Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:16.580Z"}}},"related_cves":[{"value":"CVE-2026-95715","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e7e2e3e3-8075-441a-b283-cc3b47801804","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95715","advisory_id":"e7e2e3e3-8075-441a-b283-cc3b47801804","event_types":["advisory"],"published_at":"2026-10-25T14:56:17.772442+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:05.183+00:00","detail_url":"/events/53151"}]}},{"id":53621,"cve_ids":["CVE-2026-95713"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface","summary":"An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.","evidence":"cve:CVE-2026-95713","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95713","aliases":["CVE-2026-95713"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:13.819Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95713","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:57:04.750181Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:57:21.091Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:13.819Z"}}},"related_cves":[{"value":"CVE-2026-95713","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95713","advisory_id":"7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","event_types":["advisory"],"published_at":"2026-10-25T14:56:17.126688+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:02.75+00:00","detail_url":"/advisories/advisory%3A7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","group":{"id":"advisory:7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","revision":1,"primary_event_id":53150,"change":"published","superseded_by":[],"changed":{"id":53150,"cve_ids":["CVE-2026-95713"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface","summary":"An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.","evidence":"cve:CVE-2026-95713","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95713","aliases":["CVE-2026-95713"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:13.819Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95713","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:57:04.750181Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:57:21.091Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:13.819Z"}}},"related_cves":[{"value":"CVE-2026-95713","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95713","advisory_id":"7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","event_types":["advisory"],"published_at":"2026-10-25T14:56:17.126688+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:02.75+00:00","detail_url":"/events/53150"},"members":[{"id":53150,"cve_ids":["CVE-2026-95713"],"payload":{"kind":"advisory","title":"Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface","summary":"An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.","evidence":"cve:CVE-2026-95713","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95713","aliases":["CVE-2026-95713"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:13.819Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95713","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:57:04.750181Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-119","description":"CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:57:21.091Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:13.819Z"}}},"related_cves":[{"value":"CVE-2026-95713","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95713","advisory_id":"7df61cfe-23e6-4621-b96b-3ac5d8e94ff3","event_types":["advisory"],"published_at":"2026-10-25T14:56:17.126688+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:02.75+00:00","detail_url":"/events/53150"}]}},{"id":53620,"cve_ids":["CVE-2026-95712"],"payload":{"kind":"advisory","title":"Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol","summary":"A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.","evidence":"cve:CVE-2026-95712","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95712","aliases":["CVE-2026-95712"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:12.463Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95712","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:58:05.768673Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:58:09.901Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:12.463Z"}}},"related_cves":[{"value":"CVE-2026-95712","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:45dd3b9b-9714-4ecf-8af1-5e28cd307649","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95712","advisory_id":"45dd3b9b-9714-4ecf-8af1-5e28cd307649","event_types":["advisory"],"published_at":"2026-10-25T14:56:16.504852+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:01.347+00:00","detail_url":"/advisories/advisory%3A45dd3b9b-9714-4ecf-8af1-5e28cd307649","group":{"id":"advisory:45dd3b9b-9714-4ecf-8af1-5e28cd307649","revision":1,"primary_event_id":53149,"change":"published","superseded_by":[],"changed":{"id":53149,"cve_ids":["CVE-2026-95712"],"payload":{"kind":"advisory","title":"Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol","summary":"A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.","evidence":"cve:CVE-2026-95712","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95712","aliases":["CVE-2026-95712"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:12.463Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95712","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:58:05.768673Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:58:09.901Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:12.463Z"}}},"related_cves":[{"value":"CVE-2026-95712","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:45dd3b9b-9714-4ecf-8af1-5e28cd307649","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95712","advisory_id":"45dd3b9b-9714-4ecf-8af1-5e28cd307649","event_types":["advisory"],"published_at":"2026-10-25T14:56:16.504852+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:01.347+00:00","detail_url":"/events/53149"},"members":[{"id":53149,"cve_ids":["CVE-2026-95712"],"payload":{"kind":"advisory","title":"Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol","summary":"A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.","evidence":"cve:CVE-2026-95712","products":[{"name":{"value":"ArubaOS (AOS)","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-95712","aliases":["CVE-2026-95712"],"metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"ADJACENT_NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","versions":[{"status":"affected","version":"8.13.0.0","versionType":"semver","lessThanOrEqual":"8.13.3.0"},{"status":"affected","version":"8.10.0.0","versionType":"semver","lessThanOrEqual":"8.10.0.23"}],"defaultStatus":"affected"}],"modified":"2026-10-23T19:14:12.463Z","provider":"cve","references":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-95712","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-23T15:58:05.768673Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-23T15:58:09.901Z"}}],"cna":{"orgId":"eb103674-0d28-4225-80f8-39fb86215de0","shortName":"hpe","dateUpdated":"2026-10-23T19:14:12.463Z"}}},"related_cves":[{"value":"CVE-2026-95712","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:45dd3b9b-9714-4ecf-8af1-5e28cd307649","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-95712","advisory_id":"45dd3b9b-9714-4ecf-8af1-5e28cd307649","event_types":["advisory"],"published_at":"2026-10-25T14:56:16.504852+00:00","technologies":["arubaos-aos","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-22T19:07:01.347+00:00","detail_url":"/events/53149"}]}}],"next_after":56266,"next_before":53620}