---
id: "CVE-2026-79851"
kind: "vulnerability"
aliases: ["CVE-2026-79851"]
title: "HPE Aruba AOS-10: buffer overflow lets an unauthenticated attacker run code as root"
severity: "critical"
cvss: 10.0
epss: 0.00761
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.4.1.14", "10.7.2.7", "10.8.1.2"], "affected": ">= 10.3.0.0, <= 10.4.1.13; >= 10.6.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-10", "aruba", "hpe", "infrastructure", "network-appliance", "rce", "unauthenticated"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-22T19:17:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79851", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:59:37+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79851", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-10: buffer overflow lets an unauthenticated attacker run code as root

A buffer overflow in an AOS-10 network interface lets an unauthenticated remote attacker run arbitrary code as a privileged user on the underlying operating system. The sources report full system compromise of the affected controller or gateway.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected >= 10.3.0.0, <= 10.4.1.13; >= 10.6.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1 fixed 10.4.1.14, 10.7.2.7, 10.8.1.2

## How to check

Check the installed AOS-10 version (unknown for the exact command; sources do not say) and compare it to the affected ranges: 10.3.0.0 to 10.4.1.13, 10.6.0.0 to 10.7.2.6, 10.8.0.0 to 10.8.1.1.

## Fix

Upgrade to 10.4.1.14, 10.7.2.7, or 10.8.1.2 (the fixed release for each branch).

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79851
- 2026-10-23T21:59:37+00:00 analyst — HPE bulletin HPESBNW05162 (22 Oct 2026) page renders only in a browser, so I couldn't read it; versions come from BleepingComputer, TrustList (citing the CVE records and the Canadian Cyber Centre) and VulDB. The specific interface is unnamed (HPE says only 'the affected interface'). HPE says no known exploitation or public PoC. I found no X or HN discussion and did not search them.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79851

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
- [fix] TrustList: HPE fixes maximum-severity flaws in Aruba AOS-10 and AOS-8 https://trustlist.uk/security-advisories/hpe-aruba-aos-10-and-aos-8-wireless-flaws-cvss-10-unauthenticated-rce-fixed-10-8-1-2-and-8-13-3-1
- [mentions] VDB-425477 HPE AOS-10 up to 10.4.1.13/10.7.2.6/10.8.1.1 code injection https://vuldb.com/vuln/425477

## From the sources

Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_