HPE ArubaOS 10: Memory corruption leads to remote code execution
Summary
Memory corruption vulnerabilities in an interface of HPE ArubaOS 10 (AOS-10) allow an unauthenticated attacker on the same local network or in radio range to execute code remotely. Successful exploitation gives code execution as a privileged user on the underlying operating system of the controller, gateway or access point. The attacker needs no login and no user interaction, but must be adjacent to the device. The CWE is disputed: the CVE record lists CWE-119, while VulDB lists CWE-94.
Affected
- ArubaOS 10.8.0.0 to 10.8.1.1
- ArubaOS 10.7.0.0 to 10.7.2.6
- ArubaOS 10.4.0.0 to 10.4.1.13
- Branch 10.3 (lower bound and status unconfirmed; third-party sources only)
Fixed in
- ArubaOS 10.8.1.2 or later
- ArubaOS 10.7.2.7 or later
- ArubaOS 10.4.1.14 or later
- Fix for the 10.3 branch: unknown
- Fixed versions come from secondary sources and must be checked against the HPE advisory HPESBNW05162.
Workaround
No CVE-specific workaround known. Apply the patch as the primary control. Restrict access to AOS-10 management interfaces from user and guest networks.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No known exploitation in the wild according to HPE and CISA.
- No public proof-of-concept exploit found.
- Not listed in CISA KEV in secondary sources; the catalog check predates the bulletin by one day.
- VulDB: EPSS 0.00000, KEV no.
Our recommendation
- Inventory all ArubaOS 10 devices (controllers, gateways, access points) and their versions.
- Upgrade affected devices to the fixed release of their branch in the next maintenance window; verify the version table in HPE advisory HPESBNW05162.
- Replace or upgrade devices still on branch 10.3 or on end-of-maintenance releases.
- Check whether management interfaces are reachable from guest, user or foreign VLANs and restrict them.
- Monitor for unusual activity on wireless controllers and gateways.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB CVE-2026-79879 vuldb.com
- Strix.ai CVE-2026-79879 www.strix.ai
- Rescana: HPE Aruba AOS bulletin summary (October 2026) www.rescana.com
- Safeguard.sh: HPE Aruba AOS 8 and AOS 10 CVE-2026-79844 analysis safeguard.sh
- SecurityOnline: HPE Networking AOS vulnerabilities securityonline.info
- The Backroom Tech: HPE patches 72 ArubaOS vulnerabilities thebackroomtech.com
- BleepingComputer: HPE patches eight max-severity RCE and auth bypass AOS flaws www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:53.
Original description (NVD)
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.