Live › vulnerability › CVE-2026-79847
Go to dashboardHPE Networking AOS-10 (Mobility Conductors, Controllers, Central-managed Gateways, AOS-10 APs) has unauthenticated buffer overflows (CVE-2026-79847, 7 internal VULN refs). Specially crafted packets sent to an unnamed network interface give code execution as a privileged OS user. CVSS 10.0. Found by HPE internal research; HPE knows of no public PoC or exploitation. Part of a 72-CVE bulletin that also covers AOS-8. The sibling CVE-2026-79851 is another AOS-10 buffer overflow.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HPE Networking AOS-10 | vendor | >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.1310.6.0.0 and 10.3.0.0 as lower bounds10.7.2.7 or 10.4.1.14 (or later in your train); download from networkingsupport.hpe.comEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79847")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.