HPE ArubaOS AOS-8: Buffer overflow in command line interface
Summary
A buffer overflow in the command line interface of HPE ArubaOS AOS-8 allows an unauthenticated remote attacker to run arbitrary commands on the underlying host if preconditions outside the attacker's control are met. Successful exploitation could lead to code execution as a privileged user and complete compromise of the system. The CVSS score is 8.1 (HIGH) and the weakness is CWE-119. Attack complexity is high, so exploitation depends on conditions the attacker cannot control.
Affected
- ArubaOS AOS-8 8.13.0.0 to 8.13.3.0
- ArubaOS AOS-8 8.10.0.0 to 8.10.0.23
Note: Some secondary sources list 8.12.x as affected; the official CVE record does not. Verify against the HPE bulletin.
Fixed in
- AOS-8 8.13.3.1 or later (8.13.x branch)
- AOS-8 8.10.0.24 or later (8.10.x branch)
- Branch 8.12: no separate fix; move to 8.13.3.1 or later
Source: secondary reports citing HPE. Verify in HPESBNW05162.
Workaround
- HPE interim guidance, as summarised by third parties: restrict access to the management interface until patched.
- Unknown: no CLI-specific workaround has been confirmed.
Exploitation
- HPE and secondary sources report no known exploitation and no public exploit code.
- Not listed in the CISA KEV catalogue (checked 24 Oct 2026).
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
Our recommendation
- Inventory all AOS-8 Mobility Conductors, Mobility Controllers and Instant Access Points, including their versions.
- Patch to the fixed builds and apply the whole HPE bulletin together.
- Until patched, restrict management access to trusted admin networks; prioritise devices reachable from the internet, guest or user networks.
- Monitor the HPE bulletin and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CVE record and CVSS details (threatint) cve.threatint.com
- VulDB CVE-2026-79891 vuldb.com
- CNNVD entry with fix thresholds (Vulners) vulners.com
- Aviatrix summary of HPE interim guidance aviatrix.ai
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- Safeguard: AOS-8 and AOS-10 vulnerability overview safeguard.sh
- Brandefense: HPE Aruba AOS vulnerabilities brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:06.
Original description (NVD)
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.