Zero Radar
← feed
CriticalVulnerabilityCVE-2026-79874updated 25 Oct 2026, 16:50 UTC

AOS-10 API lets attackers skip login and gain admin access

A flaw in the AOS-10 management API lets someone nearby, without a password, get past the login check. They could then take over the device, change its settings, and read or change sensitive data.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Adjacent networkAttacker is on a nearby network segment
  2. 2AOS-10 APISends request without valid credentials
  3. 3Auth bypassAuthentication check is circumvented
  4. 4Admin accessGains administrative control of the system
  5. ResultAttacker gains administrative control

What happened

An authentication bypass in the AOS-10 API allows an unauthenticated adjacent attacker to circumvent existing authentication controls, potentially reaching administrative access.

Why it is dangerous: A successful attacker could gain administrative control, alter system configurations, and access or manipulate sensitive data. Anyone running AOS-10 with the API reachable from an adjacent network segment is exposed.

Are you affected?

You are affected if you run AOS-10 with its API reachable by an adjacent network attacker (affected versions not stated in the material).

What to do

  1. Check the vendor advisory for patched AOS-10 versions and apply the update as soon as possible
  2. Restrict access to the AOS-10 management API to trusted administrative networks only
  3. Review admin accounts and configuration logs for unexpected changes

Timeline

  1. 22 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-79874 · GHSA-xm8p-hm8m-mf6g
CVSS
9.3 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 19:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

AOS-10 API lets attackers skip login and gain admin access · Zero Radar