HPE ArubaOS AOS-8: Unauthenticated buffer overflow in web interface
Summary
An unauthenticated remote attacker can trigger a buffer overflow in a web interface endpoint of AOS-8 devices. Successful exploitation could allow arbitrary command execution on the underlying operating system and complete compromise of the device. HPE rates the issue with CVSS 8.1 (High); exploitation requires high attack complexity, and the exact trigger conditions are not publicly documented.
Affected
- ArubaOS (AOS-8) 8.13.0.0 to 8.13.3.0
- ArubaOS (AOS-8) 8.10.0.0 to 8.10.0.23
- Older branches: treat as at risk, as HPE presumes software beyond maintenance affected unless excluded
- Unverified: 8.12 branches (listed by some aggregators only, not confirmed by HPE)
Fixed in
- ArubaOS (AOS-8) 8.13.3.1
- ArubaOS (AOS-8) 8.10.0.24
- Later releases containing the fixes
Workaround
- HPE recommends restricting command line and web management interfaces to a dedicated Layer 2 segment or VLAN
- Apply firewall controls at Layer 3 and above
- Enable accounting controls to track user activities and resource usage
- No CVE-specific workaround documented by the vendor
Exploitation
- HPE states it knows of no public exploit code or exploitation
- Not listed in CISA KEV at the time of research
- No public proof-of-concept found; this does not rule one out
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
Our recommendation
- Inventory AOS-8 controllers, gateways and access points in the affected version ranges
- Upgrade to 8.13.3.1, 8.10.0.24 or a later fixed release
- Confirm the web management interface is not reachable from guest, user or WAN segments
- Place management on a dedicated VLAN and restrict access with firewall rules
- Patch the whole HPE bulletin HPESBNW05162, as other flaws on the platform are rated higher
- Monitor logs for unusual requests to the management web interface
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB CVE-2026-79888 vuldb.com
- Cyberpress: Critical HPE Aruba AOS-8 vulnerability cyberpress.org
- Guyana National CIRT advisory ADV2026_697 cirt.gy
- Rescana: HPE Aruba AOS advisory overview www.rescana.com
- Safeguard.sh: HPE Aruba AOS-8/AOS-10 vulnerabilities safeguard.sh
- Skycloak: Aruba AOS patch and rotate secrets skycloak.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:04.
Original description (NVD)
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.