HPE AOS-Switch: Unauthenticated buffer overflow leads to remote code execution
Summary
HPE's AOS-S switch firmware contains an unauthenticated buffer overflow (CWE-120) with a CVSS score of 9.8. HPE has not named the affected interface. An attacker on the network who can reach the switch without credentials could execute arbitrary code on the device. Exploitation requires network access to the affected management interface, and HPE reports no known public exploit at the time of its advisory.
Affected
- HPE AOS-Switch (AOS-S) 16.11.0000 through 16.11.0031 (CNA record)
- HPE advisory: AOS-S 16.11.0031 and below
- Releases past End of Support: not assessed by HPE
- Affected models named by the Belgian CCB include 2530, 2540, 2615, 2620, 2915, 2920, 2930F and 2930M (list truncated in the source)
Fixed in
Unknown. No fixed firmware version was found in the sources. Check HPE advisory HPESBNW05156 (rev 2) and the AOS-S release notes for the first build that addresses it.
Workaround
- HPE recommends restricting CLI and web management interfaces to a dedicated layer 2 segment or VLAN and/or controlling access with layer 3+ firewall policies, with accounting for logging user activity.
- Remove any internet exposure of switch management ports.
- Block management traffic from user and guest networks.
- No vendor-confirmed workaround removes the flaw; network restriction only reduces exposure.
Exploitation
- HPE was not aware of public discussion or exploit code at the time of its advisory.
- CISA SSVC data: Exploitation none, Automatable yes, Technical Impact total.
- OpenCVE lists CISA KEV as No; this was not verified directly against the KEV catalogue.
- EPSS below 1 percent.
- No public proof of concept was found.
Our recommendation
- Inventory all AOS-S switches, including branch and remote units, and record their firmware versions.
- Restrict management access to a dedicated management VLAN or jump host now.
- Log and monitor management access.
- Check HPE advisory HPESBNW05156 for a fixed build and apply it as soon as it is available.
- Investigate immediately if there is any sign of compromise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05156 support.hpe.com
- CCB Belgium advisory on HPE AOS-S vulnerabilities ccb.belgium.be
- Canadian Cyber Centre HPE security advisory AV26-1011 www.cyber.gc.ca
- CIRCL CVE premium record CVE-2026-76744 cvepremium.circl.lu
- OpenCVE record CVE-2026-76744 app.opencve.io
- Securityonline report on HPE AOS-Switch vulnerabilities securityonline.info
- AOS-Switch release notes PDFs arubanetworking.hpe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:03.
Original description (NVD)
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.