HPE ArubaOS: Unauthenticated buffer overflow allows remote code execution
Summary
A buffer overflow in the underlying operating system of HPE ArubaOS (AOS-8 and AOS-10) can be triggered by an unauthenticated remote attacker over the network. Successful exploitation allows arbitrary code execution as a privileged user on the operating system of the affected device. The CVSS base score is 9.4 (critical). Exposure depends on whether controllers, gateways or management interfaces are reachable from untrusted networks.
Affected
- ArubaOS 10.8.0.0 to 10.8.1.1 - ArubaOS 10.7.0.0 to 10.7.2.6 - ArubaOS 10.4.0.0 to 10.4.1.13 - ArubaOS 8.13.0.0 to 8.13.3.0 - ArubaOS 8.10.0.0 to 8.10.0.23. Per-CVE range to be confirmed against the HPE CSAF file, as sources conflict on the 10.6, 10.3 and 8.12 branches.
Fixed in
- AOS-10 10.8.1.2 - AOS-10 10.7.2.7 - AOS-10 10.4.1.14 - AOS-8 8.13.3.1 - AOS-8 8.10.0.24, or later on the same branch. Source: HPE advisory HPESBNW05162 (to be verified).
Workaround
No CVE-specific workaround known. Interim mitigation according to HPE: restrict access to the management interfaces from untrusted networks until patched. Patching is the primary fix.
Exploitation
- No known exploitation in the wild as of 2026-10-26. - Not listed in the CISA KEV catalogue. - HPE is not aware of public exploit code as of the advisory date. - Status as of 2026-10-22 to 2026-10-26; monitor for changes.
Our recommendation
- Inventory all AOS-8 and AOS-10 devices (controllers, gateways, access points) and their exact builds. - Patch to the fixed builds, starting with controllers and conductors, then access points. - Restrict management and PAPI access from untrusted networks until patched. - Verify the per-CVE affected range in the HPE CSAF file before scoping. - Monitor HPE, CISA KEV and NVD for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB entry 425454 (conflicting data) vuldb.com
- Strix CVE record CVE-2026-79872 www.strix.ai
- Rescana analysis of the HPE ArubaOS advisory www.rescana.com
- CyberExperts: Aruba AOS wireless patches cyberexperts.com
- pwn.watch: HPE Aruba AOS critical RCE pwn.watch
- Brandefense knowledge hub (AOS vulnerabilities) brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:55.
Original description (NVD)
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.