HPE ArubaOS 8: Memory corruption allows local code execution
Summary
HPE ArubaOS 8 (AOS-8) contains a memory corruption vulnerability (CVE-2026-79892) in Mobility Conductors, Mobility Controllers and Gateways. An attacker who already has valid local credentials can execute arbitrary code, potentially as a privileged user on the underlying operating system. The vulnerability has no known exploitation and is not in the CISA KEV catalogue, but a compromised controller would expose its traffic and configuration. The CWE classification is still unresolved (CWE-119 in the record, CWE-269 per VulDB).
Affected
- AOS-8.13.0.0 to 8.13.3.0 (per CNA record)
- AOS-8.10.0.0 to 8.10.0.23 (per CNA record)
- The status of the 8.12 branch is unverified and must be checked in the HPE advisory version table.
Fixed in
- AOS-8.13.3.1 or later
- AOS-8.10.0.24 or later
- Fixed release details are taken from secondary reporting and should be confirmed in HPE advisory HPESBNW05162.
Workaround
- No CVE-specific workaround is published.
- General HPE hardening from secondary reports: restrict CLI and web management access to a dedicated management VLAN or segment, or behind firewall rules, and enable accounting.
- Limit local shell and CLI accounts and review administrator access.
Exploitation
- No evidence of exploitation in the wild.
- Not listed in the CISA KEV catalogue (checked 24 October 2026).
- HPE is not aware of public exploit code.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS below 1%.
Our recommendation
- Confirm whether AOS-8 controllers are in use and which versions they run.
- Upgrade affected controllers to AOS-8.13.3.1 or AOS-8.10.0.24 or later.
- Patch all flaws in HPE advisory HPESBNW05162 in one maintenance window, including the CVSS 10.0 flaws CVE-2026-79844 to CVE-2026-79851, which are the higher priority.
- Restrict management access and review administrator and local account privileges.
- Monitor controller logs for unusual logins and changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- OpenCVE: CVE-2026-79892 app.opencve.io
- VulDB: CVE-2026-79892 vuldb.com
- Cyberexperts: Aruba AOS wireless patches cyberexperts.com
- Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- Brandefense: CVE-2026-79844 brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:42.
Original description (NVD)
A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.