HPE ArubaOS AOS-10: Unauthenticated buffer overflow leads to remote code execution
Summary
A buffer overflow in an AOS-10 interface of HPE ArubaOS allows an unauthenticated remote attacker to execute arbitrary code. Successful exploitation would grant code execution as a privileged user on the underlying operating system and therefore full compromise of the device. The affected interface is not confirmed in the sources reviewed, and no login or user interaction is required. The CVSS score is 10.0 (critical), and the advisory covers Mobility Conductors, Mobility Controllers, Mobility Gateways and AOS-10 access points.
Affected
- AOS-10.8: 10.8.0.0 to 10.8.1.1
- AOS-10.7: 10.7.0.0 to 10.7.2.6
- AOS-10.4: 10.4.0.0 to 10.4.1.13
- Status of the 10.6 and 10.3 branches: conflicting sources, check the HPE advisory
- Status of earlier branches: Unknown.
Fixed in
- AOS-10.8.1.2
- AOS-10.7.2.7
- AOS-10.4.1.14
- Later releases in each branch also contain the fix.
Workaround
- HPE recommends restricting access to the CLI and web-based management interfaces to dedicated layer 2 segments or VLANs and controlling access with layer 3 firewall policies.
- These measures reduce exposure only. No workaround removes the vulnerability.
Exploitation
- HPE is not aware of exploitation in the wild or of public exploit code as of the advisory date.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in the CISA KEV catalogue at the time of research.
- The information is a point-in-time view.
Our recommendation
- Patch AOS-10 devices to the fixed versions via the HPE Networking Support Portal, prioritising gateways and controllers.
- Restrict management interfaces and UDP port 8211 (PAPI) to an administration segment and remove any internet exposure (NAT, port forwarding, VPN portals).
- Check whether AOS-8 devices are in use and upgrade them to 8.13.3.1 or 8.10.0.24.
- Monitor for unusual behaviour on wireless controllers and gateways and review network segmentation to limit lateral movement.
- Confirm the patch process with your managed-service provider if devices are managed through Central.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB CVE-2026-79851 vuldb.com
- SecurityWeek: HPE patches dozens of critical flaws www.securityweek.com
- BleepingComputer: HPE patches eight max-severity RCE and auth bypass flaws www.bleepingcomputer.com
- Rescana: HPE Aruba AOS bulletin analysis www.rescana.com
- CCB Belgium advisory ccb.belgium.be
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:58.
Original description (NVD)
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.