Zero Radar
← feed
CriticalVulnerabilityCVE-2026-79855updated 25 Oct 2026, 16:50 UTC

AOS-8 SSH service lets remote attackers skip login and gain admin control

A flaw in the remote-login service on AOS-8 devices lets an outsider get past the password check without logging in. Once in, they can take full control of the device.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo credentials or prior access needed
  2. 2Reaches SSH daemonConnects to AOS-8 SSH service over network
  3. 3Authentication bypassedLogin checks are circumvented
  4. 4Admin privileges gainedAttacker obtains administrative access
  5. ResultAttacker fully controls the AOS-8 host

What happened

An authentication bypass in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent authentication controls and obtain administrative privileges.

Why it is dangerous: An attacker who reaches the SSH service over the network can fully compromise the AOS-8 host, which is a critical risk for any network that exposes it.

Are you affected?

You are affected if you run AOS-8 with the SSH daemon reachable from networks an attacker could access.

AOS-8 (exact versions not stated in the provided material)

What to do

  1. Restrict SSH access to AOS-8 devices to trusted management networks only
  2. Check the vendor advisory for a fixed AOS-8 release and update as soon as one is available
  3. Review AOS-8 logs for unexpected administrative logins

Timeline

  1. 22 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-79855 · GHSA-vfhh-p9v5-79v7
CVSS
9.8 / 10
EPSS
0.8% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 19:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AOS-8 SSH service lets remote attackers skip login and gain admin control · Zero Radar