---
id: "CVE-2026-79847"
kind: "vulnerability"
aliases: ["CVE-2026-79847"]
title: "Aruba AOS-10: crafted packets let unauthenticated attackers run code as root"
severity: "critical"
cvss: 10.0
epss: 0.00818
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-10", "aruba", "hpe", "infrastructure", "network-appliance", "rce", "unauthenticated", "wireless"]
not_affected_if: ["aos-8-only", "unknown"]
published_at: "2026-10-22T19:17:56+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79847", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:47:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79847", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-10: crafted packets let unauthenticated attackers run code as root

HPE Networking AOS-10 (Mobility Conductors, Controllers, Central-managed Gateways, AOS-10 APs) has unauthenticated buffer overflows (CVE-2026-79847, 7 internal VULN refs). Specially crafted packets sent to an unnamed network interface give code execution as a privileged OS user. CVSS 10.0. Found by HPE internal research; HPE knows of no public PoC or exploitation. Part of a 72-CVE bulletin that also covers AOS-8. The sibling CVE-2026-79851 is another AOS-10 buffer overflow.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking AOS-10 affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Check the AOS-10 version on each controller, gateway and AP (show version). Affected: 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13. NVD/CVE.org also list 10.6.0.0 and 10.3.0.0 as lower bounds. The advisory does not name the interface or port for this CVE. Other bugs in the same bulletin are in PAPI (UDP 8211), but do not assume that applies here. Check whether management and PAPI traffic is reachable from untrusted networks.

## Fix

Upgrade to AOS-10.8.1.2, 10.7.2.7 or 10.4.1.14 (or later in your train); download from networkingsupport.hpe.com. If you cannot patch yet: restrict CLI and web management to a dedicated L2 segment/VLAN, apply L3+ firewall policy, and enable accounting. Versions past End of Maintenance are presumed affected. Upgrade to a supported release.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79847
- 2026-10-23T22:47:38+00:00 analyst — Read HPE advisory HPESBNW05162 (CSAF text). Fixed versions and mitigation confirmed; the affected interface and port for this CVE are not named by the vendor. HPE says no PoC and no exploitation known. Social search skipped; this is a day-old advisory.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79847

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [discussion] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_