HPE AOS-10: Sensitive information disclosure in Wi-Fi frame processing
Summary
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of HPE AOS-10 allows an unauthenticated attacker within radio range to access sensitive information. The retrieved data could help an attacker reach network services supported by AOS-10 or disrupt their normal operation. The CNA rates the issue critical (CVSS 9.3), and the CISA SSVC assessment lists Automatable as no.
Affected
- HPE ArubaOS (AOS-10) 10.8.0.0 to 10.8.1.1
- HPE ArubaOS (AOS-10) 10.7.0.0 to 10.7.2.6
- HPE ArubaOS (AOS-10) 10.4.0.0 to 10.4.1.13
- Other branches: Unknown. Check the per-CVE affected table in HPESBNW05162.
Fixed in
- Reported fixed builds (secondary sources, verify against HPESBNW05162): 10.8.1.2, 10.7.2.7, 10.4.1.14
- Fixed status of other branches: Unknown.
Workaround
- No CVE-specific workaround known.
- General guidance from a secondary source: restrict access to management interfaces until patching is complete.
Exploitation
- No evidence of active exploitation known.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- VulDB: EPSS 0.00000, not listed in KEV.
- No public exploit code or proof of concept found in the sources reviewed.
Our recommendation
- Identify all AOS-10 controllers, gateways and access points and their versions.
- Confirm the fixed builds in HPESBNW05162, then patch. Apply other pending AOS-8/AOS-10 fixes in the same maintenance window.
- Until patched, restrict management interface access and review which SSIDs and sites can be reached by outsiders.
- Monitor the vendor advisory and exploitation reports for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CyberExperts: Aruba AOS wireless patches cyberexperts.com
- VulDB: CVE-2026-79876 vuldb.com
- INCIBE-CERT: CVE-2026-79876 www.incibe.es
- Strix: CVE-2026-79876 www.strix.ai
- Adyog: HPE Aruba AOS eight max severity flaws pulse.adyog.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:51.
Original description (NVD)
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.