{"id":"CVE-2026-79863","kind":"vulnerability","aliases":["CVE-2026-79863"],"related":[],"title":"Aruba AOS-10 and AOS-8 controllers: buffer overflow lets nearby attacker run code","description":"Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","summary":"HPE Aruba AOS-10 and AOS-8 wireless controllers have buffer overflows in an affected interface that accepts unauthenticated input. An attacker on an adjacent network can send crafted data and run arbitrary code as a privileged user on the underlying OS.","severity":"critical","cvss":9.6,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.4.1.14","10.7.2.7","10.8.1.2"],"affected":">= 10.4.0.0, <= 10.4.1.13; >= 10.7.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1","ecosystem":"vendor"},{"name":"AOS-8","fixed":["8.10.0.24","8.13.3.1"],"affected":">= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aos-8","aruba","hpe","infrastructure","network-appliance","wireless"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"Read the AOS version on each controller, conductor, gateway and access point (Central inventory or the device's version output) and compare with the affected ranges. Vulnerable: AOS-10 up to 10.4.1.13, 10.7.2.6, 10.8.1.1; AOS-8 up to 8.10.0.23, 8.13.3.0. Older end-of-maintenance trains are presumed vulnerable. The advisory gives no command or setting to test the interface itself. Attack needs adjacency (same L2 segment), so the management VLAN restriction HPE recommends limits exposure until you patch.","fix":"Upgrade AOS-10 to 10.4.1.14, 10.7.2.7 or 10.8.1.2, and AOS-8 to 8.10.0.24 or 8.13.3.1, depending on the branch in use.","status":"open","published_at":"2026-10-22T19:17:58+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:54+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:31:54Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-10 to 10.4.1.14, 10.7.2.7 or 10.8.1.2, and AOS-8 to 8.10.0.24 or 8.13.3.1, depending on the branch in use.","reach":"network","title":"Aruba AOS-10 and AOS-8 controllers: buffer overflow lets nearby attacker run code","impact":"high","summary":"HPE Aruba AOS-10 and AOS-8 wireless controllers have buffer overflows in an affected interface that accepts unauthenticated input. An attacker on an adjacent network can send crafted data and run arbitrary code as a privileged user on the underlying OS.","category":"infrastructure","who_cares":["aos-10","aos-8","aruba","wireless","network-appliance"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs code as privileged user on the controller OS.","analyst_note":"Identify which interface is affected and whether it is reachable from client or management networks; check the HPE Aruba security bulletin for the specific interface and mitigations.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000543,"input_tokens":3155,"output_tokens":454,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify which interface is affected and whether it is reachable from client or management networks; check the HPE Aruba security bulletin for the specific interface and mitigations.","search":"'-10':3A,22A,26B,39B,87C '-2026':16A,19A '-79863':17A,20A '-8':6A,24A,28B,42B,90C 'accept':53B 'adjac':60B,95C 'affect':50B,83C,108C 'allow':92C,113C 'ao':2A,5A,25B,27B,38B,41B,86C,89C 'aos':21A,23A 'applianc':34B 'arbitrari':68B,99C,118C 'aruba':1A,29B,37B 'attack':12A,57B,96C,115C 'buffer':8A,46B,78C 'code':14A,69B,100C,119C 'control':7A,44B 'could':91C,112C 'craft':64B,104C 'cve':15A,18A 'data':65B,105C 'execut':98C,117C 'exploit':111C 'hpe':30B,36B 'infrastructur':31B 'input':55B 'interfac':51B,84C,109C 'let':10A 'nearbi':11A 'network':33B,61B 'network-appli':32B 'oper':127C 'os':77B 'overflow':9A,47B,79C 'privileg':72B,122C 'run':13A,67B 'send':63B,102C 'special':103C 'success':110C 'system':128C 'unauthent':54B,94C 'under':76B,126C 'user':73B,123C 'vulner':80C 'wireless':35B,43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79863","severity":null,"published_at":"2026-10-22T19:17:58+00:00","modified_at":"2026-10-23T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79863:198","url":null,"severity":null,"published_at":"2026-10-23T22:18:20+00:00","modified_at":"2026-10-23T22:18:20+00:00","first_seen_at":"2026-10-23T22:18:20+00:00","fetched_at":"2026-10-23T22:18:20+00:00","note":"Read HPE signed advisory HPESBNW05162 (22 Oct 2026): shared entry with CVE-2026-79862, CVSS 9.6 adjacent. Advisory names no specific interface ('the affected interface'). No exploitation or public PoC per HPE; not checked against live CISA KEV. No X/social search done."},{"source":"analyst","external_id":"CVE-2026-79863:292","url":null,"severity":null,"published_at":"2026-10-23T22:44:56+00:00","modified_at":"2026-10-23T22:44:56+00:00","first_seen_at":"2026-10-23T22:44:56+00:00","fetched_at":"2026-10-23T22:44:56+00:00","note":"No new sources since run 198. Triage question on the interface stays unanswered: HPE bulletin HPESBNW05162 says only 'the affected interface' and gives no reachability detail. Adjacent vector (AV:A) means same L2 segment. Restored how-to-check, which showed unknown."},{"source":"epss","external_id":"CVE-2026-79863","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79863","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1379,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79863","title":"CVE.org record CVE-2026-79863","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1380,"url":"https://safeguard.sh/resources/blog/hpe-aruba-aos-8-aos-10-cve-2026-79844-72-vulnerabilities","title":"Safeguard: HPE Aruba AOS-8/10 72 CVEs","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}