HPE ArubaOS 10: Unauthenticated remote code execution via buffer overflow
Summary
Buffer overflow vulnerabilities in an interface of ArubaOS 10 (AOS-10), the wireless operating system for controllers, gateways and access points, allow an unauthenticated remote attacker to execute arbitrary code by sending specially crafted packets. Successful exploitation grants code execution as a privileged user on the underlying operating system, which can expose the internal network. The affected interface is not named in the sources reviewed, and the CVSS score is 10.0 (critical).
Affected
- AOS-10 10.8.0.0 to 10.8.1.1
- AOS-10 10.7.0.0 to 10.7.2.6
- AOS-10 10.4.0.0 to 10.4.1.13
- Older trains (10.3.x, 10.6.x): Unknown. Verify against the HPE bulletin.
Fixed in
- AOS-10 10.8.1.2 or later (10.8.x)
- AOS-10 10.7.2.7 or later (10.7.x)
- AOS-10 10.4.1.14 or later (10.4.x)
- Source: HPE bulletin HPESBNW05162 (secondary reporting; verify against the vendor bulletin)
Workaround
- No workaround for this specific CVE is documented.
- HPE provided mitigation measures, including restricting access to AOS management interfaces. Whether this blocks the affected interface is Unknown.
Exploitation
- HPE is not aware of public discussion or exploit code targeting the listed vulnerabilities as of the advisory date.
- No public PoC and no evidence of in-the-wild exploitation reported as of 24 October 2026.
- Not listed in the CISA KEV catalogue as of 24 October 2026. Current status not independently verified.
Our recommendation
- Inventory all AOS-10 devices and their exact builds (show version or HPE Networking Central).
- Patch to 10.8.1.2, 10.7.2.7 or 10.4.1.14, depending on the release train, after confirming against the HPE bulletin.
- Until patched, restrict management access and filter inbound traffic from untrusted networks, including guest Wi-Fi segments.
- Monitor controller and gateway services for unusual traffic and signs of compromise.
- Re-check CISA KEV and the HPE bulletin, as the bulletin was revised on 25 October 2026.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- BleepingComputer: HPE patches eight max-severity RCE and auth bypass AOS flaws www.bleepingcomputer.com
- Rescana: HPE Aruba AOS CVE-2026-79844 critical October 2026 www.rescana.com
- Safeguard: HPE Aruba AOS-8 and AOS-10 CVE-2026-79844 to 72 vulnerabilities safeguard.sh
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- VulDB: CVE-2026-79847 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:01.
Original description (NVD)
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.