{"id":"CVE-2026-79847","kind":"vulnerability","aliases":["CVE-2026-79847"],"related":[],"title":"Aruba AOS-10: crafted packets let unauthenticated attackers run code as root","description":"Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","summary":"HPE Networking AOS-10 (Mobility Conductors, Controllers, Central-managed Gateways, AOS-10 APs) has unauthenticated buffer overflows (CVE-2026-79847, 7 internal VULN refs). Specially crafted packets sent to an unnamed network interface give code execution as a privileged OS user. CVSS 10.0. Found by HPE internal research; HPE knows of no public PoC or exploitation. Part of a 72-CVE bulletin that also covers AOS-8. The sibling CVE-2026-79851 is another AOS-10 buffer overflow.","severity":"critical","cvss":10.0,"epss":0.00818,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aruba","hpe","infrastructure","network-appliance","rce","unauthenticated","wireless"],"not_affected_if":["aos-8-only","unknown"],"how_to_check":"Check the AOS-10 version on each controller, gateway and AP (show version). Affected: 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13. NVD/CVE.org also list 10.6.0.0 and 10.3.0.0 as lower bounds. The advisory does not name the interface or port for this CVE. Other bugs in the same bulletin are in PAPI (UDP 8211), but do not assume that applies here. Check whether management and PAPI traffic is reachable from untrusted networks.","fix":"Upgrade to AOS-10.8.1.2, 10.7.2.7 or 10.4.1.14 (or later in your train); download from networkingsupport.hpe.com. If you cannot patch yet: restrict CLI and web management to a dedicated L2 segment/VLAN, apply L3+ firewall policy, and enable accounting. Versions past End of Maintenance are presumed affected. Upgrade to a supported release.","status":"open","published_at":"2026-10-22T19:17:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:05+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-10: crafted packets let unauthenticated attackers run code as root","impact":"high","summary":"HPE Aruba AOS-10 network controllers and gateways have buffer overflows in an interface that accepts crafted packets. An unauthenticated attacker who reaches that interface can run arbitrary code as a privileged user on the device's operating system.","category":"infrastructure","who_cares":["aos-10","aruba","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code as privileged OS user on the appliance","analyst_note":"Find the vendor advisory and affected AOS-10 versions, the specific interface and ports, and whether a patch exists; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-79847.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000485,"input_tokens":2936,"output_tokens":382,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected AOS-10 versions, the specific interface and ports, and whether a patch exists; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-79847.","search":"'-10':3A,22A,24B,37B,46B,110B,122C '-2026':14A,17A,53B,105B '-79847':15A,18A,54B '-79851':106B '-8':101B '10.0':77B '7':55B '72':94B 'abil':147C 'affect':118C,137C 'also':98B 'anoth':108B 'ao':2A,23B,36B,45B,100B,109B,121C 'aos':21A 'ap':47B 'applianc':30B 'arbitrari':150C 'aruba':1A,25B 'attack':8A 'buffer':50B,111B,113C 'bulletin':96B 'central':42B 'central-manag':41B 'code':10A,69B,128C,151C 'conductor':39B 'control':40B 'could':123C 'cover':99B 'craft':4A,60B,133C 'cve':13A,16A,52B,95B,104B 'cvss':76B 'execut':70B,129C,149C 'exploit':90B,140C 'found':78B 'gateway':44B 'give':68B 'hpe':19A,26B,34B,80B,83B 'infrastructur':27B 'interfac':67B,119C,138C 'intern':56B,81B 'know':84B 'lead':124C 'let':6A 'manag':43B 'mobil':38B 'network':29B,35B,66B 'network-appli':28B 'networking':20A 'oper':159C 'os':74B 'overflow':51B,112B,114C 'packet':5A,61B,134C 'part':91B 'poc':88B 'privileg':73B,154C 'public':87B 'rce':31B 'ref':58B 'remot':127C 'research':82B 'result':144C 'root':12A 'run':9A 'send':131C 'sent':62B 'sibl':103B 'special':59B,132C 'success':139C 'system':160C 'unauthent':7A,32B,49B,126C 'under':158C 'unnam':65B 'user':75B,155C 'vuln':57B 'vulner':115C,143C 'wireless':33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79847","severity":null,"published_at":"2026-10-22T19:17:56+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79847:297","url":null,"severity":null,"published_at":"2026-10-23T22:47:38+00:00","modified_at":"2026-10-23T22:47:38+00:00","first_seen_at":"2026-10-23T22:47:38+00:00","fetched_at":"2026-10-23T22:47:38+00:00","note":"Read HPE advisory HPESBNW05162 (CSAF text). Fixed versions and mitigation confirmed; the affected interface and port for this CVE are not named by the vendor. HPE says no PoC and no exploitation known. Social search skipped; this is a day-old advisory."},{"source":"epss","external_id":"CVE-2026-79847","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79847","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}