CVE-2026-79884
Authentication Bypass leads to Sensitive Information Disclosure in AOS-8
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Authentication Bypass leads to Sensitive Information Disclosure in AOS-8
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
- Record
CVE-2026-79884- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-108384
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
- Record
EUVD-2026-108384- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vv32-76mg-552q
No description provided
No description provided
- Record
GHSA-vv32-76mg-552q- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
- Record
CVE-2026-79884- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-79884 is a high vulnerability (CVSS 8.2) in Hewlett Packard Enterprise (hpe) Arubaos (aos), published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.