# CVE-2026-79871: Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Hewlett Packard Enterprise (HPE) / ArubaOS (AOS): ≥ 10.8.0.0; ≤ 10.8.1.1 (affected, semver); ≥ 10.7.0.0; ≤ 10.7.2.6 (affected, semver); ≥ 10.4.0.0; ≤ 10.4.1.13 (affected, semver). Source: CNA: hpe

## Severity and prioritization

- CVSS 3.1: 9.6 (critical); CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; source: CNA: hpe

- CISA KEV: No listing in collected sources

- EPSS: 0.31% as of 2026-11-01; percentile 24.29%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-200

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US (CNA: hpe)

## Provenance

- CNA: hpe: https://www.cve.org/CVERecord?id=CVE-2026-79871; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-79871; retrieved 2026-11-02; source updated Not reported

Revision: 48e55b683c4a85a669b342967b24413729dfeab1b8c8c673b41863026d117599

Canonical: https://y2.dev/cve/CVE-2026-79871