---
id: "CVE-2026-79865"
kind: "vulnerability"
aliases: ["CVE-2026-79865"]
title: "HPE Aruba AOS-10: memory corruption lets adjacent attacker run code as root"
severity: "critical"
cvss: 9.6
epss: 0.00283
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.4.1.14", "10.7.2.7", "10.8.1.2"], "affected": "<= 10.4.1.13, <= 10.7.2.6 (10.7.x), <= 10.8.1.1 (10.8.x)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adjacent-network", "aos-10", "aruba", "hpe", "infrastructure", "network-gear", "rce"]
not_affected_if: ["fixed-version-installed"]
published_at: "2026-10-22T19:17:58+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79865", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:16:40+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79865", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-10: memory corruption lets adjacent attacker run code as root

HPE Aruba AOS-10 has a memory corruption flaw in an interface that an unauthenticated attacker on the adjacent network can reach. Successful exploitation lets the attacker run arbitrary code as a privileged user on the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected <= 10.4.1.13, <= 10.7.2.6 (10.7.x), <= 10.8.1.1 (10.8.x) fixed 10.4.1.14, 10.7.2.7, 10.8.1.2

## How to check

Check the AOS-10 version on each controller and gateway; affected builds are 10.4.1.13 and earlier, 10.7.x up to 10.7.2.6, and 10.8.x up to 10.8.1.1.

## Fix

Upgrade to 10.4.1.14, 10.7.2.7, 10.8.1.2 or later.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79865
- 2026-10-23T22:16:40+00:00 analyst — HPE advisory HPESBNW05162 (22 Oct 2026) covers this CVE, but the page text did not load. Versions come from VulDB and cybersecuritynews, so check them against the HPE bulletin. No exploitation or PoC found (VulDB: none; EPSS <1%, not in KEV). X and community posts not searched.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79865

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] VulDB VDB-425452 CVE-2026-79865 https://vuldb.com/vuln/425452
- [fix] HPE Warns Critical Aruba Networking Flaws https://cybersecuritynews.com/hpe-warns-aruba-networking-flaws/

## From the sources

A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_