ArubaOS: Buffer overflow enables remote code execution

Summary

Buffer overflow vulnerabilities in an unnamed interface of ArubaOS AOS-8 and AOS-10 allow an unauthenticated attacker on the same network segment to execute arbitrary code by sending crafted data. Successful exploitation can grant code execution as a privileged user on the underlying operating system of Mobility Controllers, Mobility Gateways and access points. No login or user interaction is required, but the attacker needs adjacent network access. The CNA rates the CVE 9.6 (Critical), but sources disagree on the CVSS vector and CWE, so verify both against HPE's CSAF file.

Affected

• AOS-10 10.8.0.0 to 10.8.1.1
• AOS-10 10.7.0.0 to 10.7.2.6
• AOS-10 10.4.0.0 to 10.4.1.13
• AOS-8 8.13.0.0 to 8.13.3.0
• AOS-8 8.10.0.0 to 8.10.0.23
• Branches 10.3, 10.6 and 8.12: unconfirmed, treat as potentially affected until HPE's CSAF confirms otherwise

Fixed in

• Upgrade to 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24 (per secondary source, not yet confirmed against HPE's text)

Workaround

• Keep CLI and web management interfaces on a dedicated VLAN or layer-2 segment, or restrict them with firewall rules (as reported by secondary sources)
• Restrict UDP 8211 (PAPI) to the subnets that need it
• Unknown whether these mitigations fully cover this CVE, since the affected interface is not named. Patching is the reliable fix.

Exploitation

• HPE is not aware of public exploit code or discussion of the listed vulnerabilities as of the advisory date.
• CISA SSVC: exploitation none, not automatable.
• Not listed in CISA KEV; EPSS 0.00000.
• No public proof of concept or in-the-wild exploitation found as of 30 October 2026.

Our recommendation

• Patch affected AOS-8 and AOS-10 controllers, gateways and access points to a fixed version, after confirming versions in HPE's CSAF file.
• Inventory all Mobility Conductors, Controllers, Gateways and access points, including branches 10.3, 10.6 and 8.12.
• Place management and guest networks on separate segments and restrict access to HTTPS 4343 and PAPI UDP 8211.
• Check whether management ports are reachable from untrusted networks and monitor for unusual traffic.
• Recheck CISA KEV and NVD for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE advisory HPESBNW05162 support.hpe.com
• VulDB CVE-2026-79863 vuldb.com
• Strix CVE-2026-79863 www.strix.ai
• CCB Belgium advisory ccb.belgium.be
• CyberExperts: Aruba AOS patches cyberexperts.com
• Carthage Electronics threat brief carthageelectronics.com
• The Layman Security: Aruba AOS critical flaws thelaymansecurity.com
• Rescana: HPE Aruba AOS critical October 2026 www.rescana.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:15.