EUVD-2026-29822
GHSA-h57h-82mj-62h6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
AV:N because sessions are network-based; PR:L because prior credential possession is required; C:L/I:L reflect access limited to the compromised account's original privilege scope; A:N as no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.
AnalysisAI
Session persistence in HPE Aruba Networking Wireless Operating System (AOS-8) allows an attacker who has obtained valid user credentials to retain network access even after an administrator has disabled the associated account. The flaw affects AOS versions across the 8.10, 8.12, and 8.13 branches and stems from the platform's failure to invalidate active sessions upon credential revocation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.03% at the 10th percentile, placing this squarely in the low-real-world-risk tier despite its medium CVSS score.
Technical ContextAI
The affected product is HPE Aruba Networking Wireless Operating System (AOS), a proprietary OS powering Aruba wireless LAN controllers and access points, identified by CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos):*:*:*:*:*:*:*:*. The root cause is CWE-613 (Insufficient Session Expiration): the platform fails to synchronize the account lifecycle - specifically the administrative disabling of a user account - with the invalidation of existing authenticated sessions. In properly designed session management, account revocation should trigger immediate teardown of all active tokens or sessions for that principal. AOS-8 does not enforce this, meaning sessions established before the revocation event persist until they naturally expire by timeout or logout.
RemediationAI
Consult the HPE security bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US for specific patched version numbers, as exact fix versions are not independently confirmed in the available input data - only the affected ranges (≤8.10.0.21, ≤8.12.0.6, ≤8.13.1.1) are specified. Upgrade AOS-8 to the versions prescribed by that advisory once confirmed. As a compensating control pending upgrade, administrators should explicitly terminate active sessions for any account being disabled, using whatever session management tooling the AOS CLI or management interface exposes (e.g., forcing a disconnect or clearing session tables for the specific user); this limits the persistence window to zero rather than waiting for natural expiration. Be aware that if AOS does not surface per-user session termination in the current affected versions, the only reliable mitigation is patching. Reducing session timeout values to the minimum operationally acceptable value will also shrink the exploitation window.
Remote code execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an unauthenticated rem
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker cras
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated a
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating syst
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privile
Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS
Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless
Authenticated command injection in HPE Aruba Networking's AOS-8 and AOS-10 wireless operating systems lets a high-privil
Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today