HPE ArubaOS AOS-10: Memory corruption enables remote code execution
Summary
HPE ArubaOS AOS-10, the wireless operating system for Mobility Conductors, Controllers and Gateways, Access Points and AOS-8 Instant Access Points, contains a memory corruption vulnerability in an affected interface. An unauthenticated attacker on the same network segment (adjacent) can achieve remote code execution. Successful exploitation can run arbitrary code as a privileged user on the underlying operating system, with a CVSS 3.1 score of 9.6 (critical). The exact vulnerable interface has not been confirmed by HPE in the public summaries.
Affected
- AOS-10.8.x: 10.8.0.0 to 10.8.1.1
- AOS-10.7.x: 10.7.0.0 to 10.7.2.6
- AOS-10.4.x: 10.4.0.0 to 10.4.1.13
- Branches not listed above, including end-of-maintenance releases, should be treated as affected (per a third-party briefing; verify with HPE).
Fixed in
- AOS-10.8.x: 10.8.1.2 and later
- AOS-10.7.x: 10.7.2.7 and later
- AOS-10.4.x: 10.4.1.14 and later
Workaround
Unknown. No vendor-documented workaround was found in the sources reviewed; the full HPE bulletin should be checked directly.
Exploitation
- No known exploitation in the wild, as reported by HPE.
- No public exploit code or proof of concept found.
- Not listed in CISA KEV. CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Upgrade AOS-10 and AOS-8 devices to the fixed releases listed above, and patch the whole estate together, as this CVE is part of a large batch of HPE advisory HPESBNW05162.
- Until patching, limit which hosts can reach AOS-10 devices on the adjacent network (management VLANs, guest and client segregation).
- Check whether devices run an affected version and whether they sit on flat or shared Wi-Fi or LAN segments; treat these as high priority.
- Recheck the HPE bulletin and NVD record, as the information is new and may change.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
- Carthage Electronics CVE threat brief, 24 October 2026 carthageelectronics.com
- PwnWatch: HPE Aruba AOS critical RCE, October 2026 pwn.watch
- Windows Forum: HPE Aruba AOS 8 and AOS 10 security update windowsforum.com
- Strix CVE record CVE-2026-79865 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:16.
Original description (NVD)
A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.