HPE Warns of Critical ArubaOS AOS-10 Authentication Bypass, CVE-2026-79874

Hewlett Packard Enterprise has published an advisory for CVE-2026-79874, an authentication bypass in an AOS-10 API of its ArubaOS networking software that it rates 9.3 Critical. An unauthenticated attacker on the adjacent network could circumvent authentication controls, potentially gaining administrative access, changing system configuration, or exposing sensitive data. Affected ranges include 10.8.0.0 to 10.8.1.1, 10.7.0.0 to 10.7.2.6, and 10.4.0.0 to 10.4.1.13, while AOS-8 is not listed for this CVE. HPE advises upgrading to 10.8.1.2 or later, 10.7.2.7 or later, or 10.4.1.14 or later as applicable. Public details on the exact endpoint and exploit method remain limited, and no evidence of exploitation has been reported.