{"id":"CVE-2026-79851","kind":"vulnerability","aliases":["CVE-2026-79851"],"related":[],"title":"HPE Aruba AOS-10: buffer overflow lets an unauthenticated attacker run code as root","description":"Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.","summary":"A buffer overflow in an AOS-10 network interface lets an unauthenticated remote attacker run arbitrary code as a privileged user on the underlying operating system. The sources report full system compromise of the affected controller or gateway.","severity":"critical","cvss":10.0,"epss":0.00761,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.4.1.14","10.7.2.7","10.8.1.2"],"affected":">= 10.3.0.0, <= 10.4.1.13; >= 10.6.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aruba","hpe","infrastructure","network-appliance","rce","unauthenticated"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"Check the installed AOS-10 version (unknown for the exact command; sources do not say) and compare it to the affected ranges: 10.3.0.0 to 10.4.1.13, 10.6.0.0 to 10.7.2.6, 10.8.0.0 to 10.8.1.1.","fix":"Upgrade to 10.4.1.14, 10.7.2.7, or 10.8.1.2 (the fixed release for each branch).","status":"open","published_at":"2026-10-22T19:17:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:32:03+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:32:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 10.4.1.14, 10.7.2.7, or 10.8.1.2 (the fixed release for each branch).","reach":"network","title":"HPE Aruba AOS-10: buffer overflow lets an unauthenticated attacker run code as root","impact":"high","summary":"A buffer overflow in an AOS-10 network interface lets an unauthenticated remote attacker run arbitrary code as a privileged user on the underlying operating system. The sources report full system compromise of the affected controller or gateway.","category":"infrastructure","who_cares":["aos-10","aruba","hpe","network-appliance"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code as root on the appliance, full system compromise","analyst_note":"Confirm which AOS-10 interface is affected and whether it is reachable from untrusted networks; check the HPE Aruba advisory linked from the NVD entry for the exact vulnerable service and any workaround.","how_to_check":"Check the installed AOS-10 version (unknown for the exact command; sources do not say) and compare it to the affected ranges: 10.3.0.0 to 10.4.1.13, 10.6.0.0 to 10.7.2.6, 10.8.0.0 to 10.8.1.1.","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000562,"input_tokens":3053,"output_tokens":514,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected AOS-10 versions, the affected interface and whether it is exposed by default, and any patched release; check the NVD page linked in sources.","search":"'-10':4A,22A,24B,39B,81C '-2026':16A,19A '-79851':17A,20A 'affect':67B,77C 'allow':93C 'ao':3A,23B,38B,80C 'aos':21A 'applianc':30B 'arbitrari':48B,98C 'aruba':2A,25B 'attack':10A,46B,95C 'buffer':5A,34B,71C 'code':12A,49B,88C,99C 'complet':111C 'compromis':64B,113C 'control':68B 'could':83C,92C 'cve':15A,18A 'execut':89C,97C 'exist':74C 'exploit':91C 'full':62B 'gateway':70B 'hpe':1A,26B 'infrastructur':27B 'interfac':41B,78C 'lead':84C,109C 'let':7A,42B 'network':29B,40B 'network-appli':28B 'oper':57B,107C 'overflow':6A,35B,72C 'privileg':52B,102C 'rce':31B 'remot':45B,87C 'report':61B 'root':14A 'run':11A,47B 'sourc':60B 'success':90C 'system':58B,63B,108C,112C 'unauthent':9A,32B,44B,86C 'under':56B,106C 'user':53B,103C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79851","severity":null,"published_at":"2026-10-22T19:17:57+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79851:148","url":null,"severity":null,"published_at":"2026-10-23T21:59:37+00:00","modified_at":"2026-10-23T21:59:37+00:00","first_seen_at":"2026-10-23T21:59:37+00:00","fetched_at":"2026-10-23T21:59:37+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026) page renders only in a browser, so I couldn't read it; versions come from BleepingComputer, TrustList (citing the CVE records and the Canadian Cyber Centre) and VulDB. The specific interface is unnamed (HPE says only 'the affected interface'). HPE says no known exploitation or public PoC. I found no X or HN discussion and did not search them."},{"source":"epss","external_id":"CVE-2026-79851","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79851","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1257,"url":"https://trustlist.uk/security-advisories/hpe-aruba-aos-10-and-aos-8-wireless-flaws-cvss-10-unauthenticated-rce-fixed-10-8-1-2-and-8-13-3-1","title":"TrustList: HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1258,"url":"https://vuldb.com/vuln/425477","title":"VDB-425477 HPE AOS-10 up to 10.4.1.13/10.7.2.6/10.8.1.1 code injection","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}