HPE AOS-Switch: Unauthenticated memory corruption leading to remote code execution
Summary
Memory corruption vulnerabilities in HPE AOS-Switch (AOS-S) allow an unauthenticated attacker on the same Layer 2 network segment to execute arbitrary code on the switch. The vulnerability has a CVSS score of 9.6 with a changed scope, so a compromise could extend beyond the switch itself. Attacks are not possible directly from the internet unless the management plane is exposed or an attacker already has access to the LAN.
Affected
- AOS-S 16.11.0000 to 16.11.0031 (HPE bulletin: 16.11.0031 and below)
- Per HPE, any hardware running the affected software is vulnerable; the bulletin names Aruba 2615 and 2620 series
- Switches at End of Maintenance (EoM) are presumed affected and are not covered by the advisory
- Lower bound of the range: only partly confirmed (third-party tracker)
Fixed in
Unknown. HPE has released patches; the fixed build numbers per supported branch are listed in the HPE bulletin version table, which was not retrieved.
Workaround
No vendor workaround known. Restrict access to management interfaces and limit access to the switch's Layer 2 segment.
Exploitation
- HPE states it is not aware of public discussion or exploit code as of the advisory release date (secondary source, to verify).
- Not listed in the CISA KEV catalogue according to available data (to verify directly).
- EPSS score at snapshot: 0.00235.
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Check the HPE bulletin HPESBNW05156 for fixed build numbers and apply the update to all AOS-S 16.11 switches.
- Plan replacement of EoM switches that will not receive a fix.
- Place management interfaces (web, SSH, SNMP) on a dedicated management VLAN with restricted access.
- Limit devices on the same Layer 2 segment, including guest and Wi-Fi networks, and segment them from the switch.
- Inventory all AOS-S switches and monitor for unusual switch behaviour or configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05156 support.hpe.com
- HPE CSAF advisory HPESBNW05156 csaf.arubanetworking.hpe.com
- Canadian Centre for Cyber Security AV26-1011 www.cyber.gc.ca
- SecurityOnline: HPE AOS-Switch vulnerabilities securityonline.info
- Vulners CVE-2026-76745 vulners.com
- Strix CVE-2026-76745 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:07.
Original description (NVD)
Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.