EUVD-2026-93976
GHSA-824j-mqpc-h7v9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AOS-S web management interface
-
DeliverySend crafted bypass request
-
ExploitDefeat authentication check
-
ExecutionGain administrative switch access
-
ImpactAlter config or capture traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the AOS-S web (HTTP/HTTPS) management interface of an affected HPE Aruba switch; where that interface is restricted to a management VLAN or not exposed, reachability is the primary limiting factor. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are needed against a reachable interface, so no special product configuration beyond having the web management service enabled is implied by the available data. The exact feature state and affected firmware versions are not detailed in the input and should be verified against the HPE advisory. |
| Impact | All available signals point to a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality, integrity, and availability impact (9.8 Critical), and the vulnerability class - authentication bypass on a device management interface - is consistent with that vector rather than contradicting it. However, no EPSS probability was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of 'unauthenticated remote + full admin-equivalent access to a network switch OS' means that if exploit code emerges it would likely be reliable and valuable, so this should be patched promptly even though real-world exploitation signals (EPSS/KEV/POC) are currently absent. Note: all technical detail derives from a single HPE advisory reference; independent corroboration of affected versions was not provided in the input. |
| Exploit ScenarioDerived | An attacker with network reachability to the AOS-S web management interface sends crafted requests that bypass the authentication layer, obtaining administrative access to the switch without valid credentials. From there they can alter switch configuration, reroute or capture traffic, and disrupt the network. No public exploit is identified at time of analysis, but the low attack complexity means a working exploit would be straightforward once the bypass is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated remote attackers can bypass authentication in the web management interface of HPE AOS-S (ArubaOS-Switch), gaining full administrative control of the switch, as reflected in the 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Any device with the HTTP/HTTPS management service reachable from an untrusted network is exposed, and because the vector requires no credentials and no user interaction, network reachability of that interface is the primary limiting factor. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation; this is a genuine high-priority issue whose exact affected firmware versions and fixed releases are not detailed in the available data and must be confirmed against the HPE advisory.
RemediationAI
Apply the HPE firmware update identified in the vendor advisory (hpesbnw05156en_us); the provided data does not specify an exact fixed version, so the appropriate target release and the full list of affected versions must be confirmed directly against that advisory, and no version numbers should be assumed. Until patched, the most effective compensating control is reachability restriction, since that is the primary exploitation prerequisite: place the switch web management interface on a dedicated management VLAN and enforce ACLs or firewall rules that permit TCP 80/443 to the switch only from trusted administrative jump hosts, accepting the operational trade-off that administrators and management tooling must now originate from those hosts. Where the web GUI is not required, disable the HTTP/HTTPS management service via the switch CLI - the trade-off is loss of the graphical interface and any REST/API integrations that depend on it, so confirm monitoring and automation dependencies before doing so - and use the CLI/SSH management path instead. Do not expose the management interface to the internet or to user VLANs under any circumstance, and add detection for unexpected successful logins, configuration changes, new local accounts, or SNMP/VLAN modifications on AOS-S devices, alongside a precautionary rotation of device credentials and review of running configurations for unauthorized edits.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-S is the switch operating system used across HPE/Aruba switching platforms, and it ships with a built-in web management interface (HTTP/HTTPS) that exposes device configuration, VLAN and port settings, ACLs, and credential management, frequently alongside a REST/API surface. The reported defect is an authentication bypass in that web service, matching the supplied 'Authentication Bypass' tag; although no CWE identifier is assigned in the input, the behavior corresponds to the improper/missing authentication class (CWE-287/CWE-306), where the management endpoint processes privileged requests without correctly validating an authenticated session. The CVSS vector is network-exploitable with no privileges (PR:N) and no user interaction (UI:N), and scope is unchanged (S:U) because impact remains within the vulnerable switch OS, while confidentiality, integrity, and availability are all rated High - consistent with an attacker reading device secrets and rewriting forwarding, segmentation, or ACL configuration that governs the surrounding network. No CPE strings were supplied, so the precise model and firmware combinations covered cannot be enumerated from this data alone, and the HPE advisory (hpesbnw05156en_us) is the authoritative source for the affected release matrix.
Know when Aruba gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated bypass reachable over the network with low complexity (AV:N/AC:L/PR:N/UI:N), yielding administrative control of the switch, so C/I/A all High.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
Executive ViewAI
HPE ArubaOS-Switch devices with web management interfaces exposed to untrusted networks are at risk of complete administrative takeover by unauthenticated remote attackers. This critical vulnerability could enable attackers to manipulate network traffic, cause outages, or access sensitive data, impacting the entire organization's network integrity. Leadership should prioritize immediate mitigation because no vendor-released patch identified at time of analysis and the potential for severe business disruption is high.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to the HTTP/HTTPS management interface to trusted networks only; disable the web management service if not required; monitor for unauthorized access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated r
There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code
A remote execution of arbitrary commands vulnerability was discovered in some Aruba Instant Access Point (IAP) products
Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access
Aruba Networks ClearPass before 6.3.6 and 6.4.x before 6.4.1 does not properly restrict access to unspecified administra
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote at
Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via u
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
Unauthenticated remote attackers can trigger buffer overflows in an interface of HPE Aruba AOS-S (ArubaOS-Switch) that i
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially
A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in ve
Exploit-DB