A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
Critical 9.6
CVE-2026-79871
HPE ArubaOS (AOS) — information disclosure.
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information.
WeaknessCWE-200: Information disclosure
Published Updated Source NVD
CVSS 3.1
9.6
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.3%
Higher than 24% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run HPE ArubaOS (AOS), and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in HPE ArubaOS (AOS)
31 more CVEs
9.3HPE ArubaOS (AOS) — information disclosure.EPSS 0.2%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.4HPE ArubaOS (AOS) — remote code execution.EPSS 0.6%