--- id: "CVE-2026-79863" kind: "vulnerability" aliases: ["CVE-2026-79863"] title: "Aruba AOS-10 and AOS-8 controllers: buffer overflow lets nearby attacker run code" severity: "critical" cvss: 9.6 epss: 0.00217 exploited: false status: "open" category: "infrastructure" products: [{"name": "AOS-10", "fixed": ["10.4.1.14", "10.7.2.7", "10.8.1.2"], "affected": ">= 10.4.0.0, <= 10.4.1.13; >= 10.7.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1", "ecosystem": "vendor"}, {"name": "AOS-8", "fixed": ["8.10.0.24", "8.13.3.1"], "affected": ">= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["aos-10", "aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "wireless"] not_affected_if: ["version-outside-affected-ranges"] published_at: "2026-10-22T19:17:58+00:00" first_seen_at: "2026-10-23T21:57:32+00:00" updated_at: "2026-10-25T12:38:51+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79863", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:18:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:44:56+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79863", "first_seen_at": "2026-10-24T07:15:51+00:00"}] --- # Aruba AOS-10 and AOS-8 controllers: buffer overflow lets nearby attacker run code HPE Aruba AOS-10 and AOS-8 wireless controllers have buffer overflows in an affected interface that accepts unauthenticated input. An attacker on an adjacent network can send crafted data and run arbitrary code as a privileged user on the underlying OS. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:AOS-10 affected >= 10.4.0.0, <= 10.4.1.13; >= 10.7.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1 fixed 10.4.1.14, 10.7.2.7, 10.8.1.2 - vendor:AOS-8 affected >= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0 fixed 8.10.0.24, 8.13.3.1 ## How to check Read the AOS version on each controller, conductor, gateway and access point (Central inventory or the device's version output) and compare with the affected ranges. Vulnerable: AOS-10 up to 10.4.1.13, 10.7.2.6, 10.8.1.1; AOS-8 up to 8.10.0.23, 8.13.3.0. Older end-of-maintenance trains are presumed vulnerable. The advisory gives no command or setting to test the interface itself. Attack needs adjacency (same L2 segment), so the management VLAN restriction HPE recommends limits exposure until you patch. ## Fix Upgrade AOS-10 to 10.4.1.14, 10.7.2.7 or 10.8.1.2, and AOS-8 to 8.10.0.24 or 8.13.3.1, depending on the branch in use. ## Timeline - 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79863 - 2026-10-23T22:18:20+00:00 analyst — Read HPE signed advisory HPESBNW05162 (22 Oct 2026): shared entry with CVE-2026-79862, CVSS 9.6 adjacent. Advisory names no specific interface ('the affected interface'). No exploitation or public PoC per HPE; not checked against live CISA KEV. No X/social search done. - 2026-10-23T22:44:56+00:00 analyst — No new sources since run 198. Triage question on the interface stays unanswered: HPE bulletin HPESBNW05162 says only 'the affected interface' and gives no reachability detail. Adjacent vector (AV:A) means same L2 segment. Restored how-to-check, which showed unknown. - 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79863 ## Documents - [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt - [describes] CVE.org record CVE-2026-79863 https://www.cve.org/CVERecord?id=CVE-2026-79863 - [mentions] Safeguard: HPE Aruba AOS-8/10 72 CVEs https://safeguard.sh/resources/blog/hpe-aruba-aos-8-aos-10-cve-2026-79844-72-vulnerabilities ## From the sources Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_