ArubaOS: Buffer overflow allows code execution by unauthenticated adjacent attacker

Summary

A buffer overflow in an affected interface of ArubaOS 8 (AOS-8) and ArubaOS 10 (AOS-10) allows an unauthenticated attacker on the same network segment to execute arbitrary code by sending specially crafted data. Successful exploitation can lead to code execution as a privileged user on the underlying operating system of the controller or access point. The attack requires adjacent network access, such as a LAN or Wi-Fi segment, but no credentials or user interaction. The vulnerable interface is not confirmed in the sources reviewed, and CVSS 9.6 is rated critical.

Affected

• AOS-10.8.0.0 to 10.8.1.1
• AOS-10.7.0.0 to 10.7.2.6
• AOS-10.4.0.0 to 10.4.1.13
• AOS-8.13.0.0 to 8.13.3.0
• AOS-8.10.0.0 to 8.10.0.23
• Affected products: Mobility Conductors, Mobility Controllers, Mobility Gateways and access points running the listed versions.
• Conflicting third-party listings also show the 10.6, 10.3 and 8.12 branches as affected; verify against the HPE CSAF file.

Fixed in

• AOS-10.8.x: 10.8.1.2 and above
• AOS-10.7.x: 10.7.2.7 and above
• AOS-10.4.x: 10.4.1.14 and above
• AOS-8.13.x: 8.13.3.1 and above
• AOS-8.10.x: 8.10.0.24 and above
• The fixes are stated in the HPE bulletin HPESBNW05162 for the bulletin as a whole; no CVE-specific fix statement was found.

Workaround

• HPE recommends keeping management interfaces off untrusted networks.
• Place CLI and web management interfaces on a dedicated VLAN or layer 2 segment, or restrict them with firewall rules, and enable accounting.
• These measures target management interfaces; the vulnerable interface for this CVE is unconfirmed, so they may not fully mitigate it. Patching is the reliable fix.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• HPE reports no public discussion or exploit code for the listed vulnerabilities.
• No evidence of exploitation in the wild or public proof of concept was found for this CVE. A secondary source reports no KEV listing as of 24 October 2026; re-check the CISA KEV catalogue.

Our recommendation

• Inventory all ArubaOS 8 and ArubaOS 10 devices (controllers, gateways, access points) and their versions.
• Upgrade affected devices to the fixed builds listed above, applying the whole HPE bulletin in one maintenance window.
• Restrict management access to a dedicated VLAN or firewall rules.
• Check that guest Wi-Fi cannot reach controller management or infrastructure segments.
• Monitor devices and logs for unexpected behaviour or crashes until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE security bulletin HPESBNW05162 support.hpe.com
• CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
• VulDB entry 425460 vuldb.com
• Strix CVE summary CVE-2026-79862 www.strix.ai
• Brandefense vulnerability overview brandefense.io
• Rescana write-up on HPE Aruba AOS www.rescana.com
• CyberExperts ArubaOS wireless patches cyberexperts.com
• Cybaverse HPE Aruba AOS critical flaws www.cybaverse.co.uk

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:14.