{"id":"CVE-2026-79872","kind":"vulnerability","aliases":["CVE-2026-79872"],"related":[],"title":"Aruba AOS-10 and AOS-8 controllers: buffer overflow gives remote root code execution","description":"A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","summary":"A buffer overflow in the underlying operating system of HPE Aruba AOS-10 and AOS-8 controllers lets an unauthenticated remote attacker run arbitrary code. The code runs as a privileged user on the device.","severity":"critical","cvss":9.4,"epss":0.00439,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":"<= 10.8.1.1; <= 10.7.2.6; <= 10.4.1.13","ecosystem":"vendor"},{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"<= 8.13.3.0; <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos","aos-10","aos-8","aruba","buffer-overflow","hpe","infrastructure","network-appliance","rce"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14; upgrade AOS-8 to 8.13.3.1 or 8.10.0.24, per the affected version ranges listed.","status":"resolved","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:48+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:31:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14; upgrade AOS-8 to 8.13.3.1 or 8.10.0.24, per the affected version ranges listed.\nunknown","reach":"network","title":"Aruba AOS-10 and AOS-8 controllers: buffer overflow gives remote root code execution","impact":"high","summary":"A buffer overflow in the underlying operating system of HPE Aruba AOS-10 and AOS-8 controllers lets an unauthenticated remote attacker run arbitrary code. The code runs as a privileged user on the device.","category":"infrastructure","who_cares":["aos-10","aos-8","aruba","network-appliance"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as root on the controller remotely.","analyst_note":"Confirm exposed interface and any mitigation for affected versions at the HPE/Aruba advisory; the sources give only NVD and the description.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000526,"input_tokens":3086,"output_tokens":434,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give no affected AOS versions, vendor advisory, or patch; check the NVD entry and the vendor advisory for the AOS product named in the description.","search":"'-10':3A,22A,27B,52B '-2026':16A,19A '-79872':17A,20A '-8':6A,24A,29B,55B 'abil':108C 'ao':2A,5A,25B,26B,28B,51B,54B,86C 'aos':21A,23A 'applianc':38B 'arbitrari':63B,111C 'aruba':1A,30B,50B 'attack':61B,99C 'buffer':8A,32B,41B,76C 'buffer-overflow':31B 'code':13A,64B,66B,93C,112C 'control':7A,56B 'could':88C 'cve':15A,18A 'devic':74B 'execut':14A,94C,110C 'exist':79C 'exploit':101C 'give':10A 'hpe':34B,49B 'infrastructur':35B 'lead':89C 'let':57B 'network':37B 'network-appli':36B 'oper':46B,83C,120C 'overflow':9A,33B,42B,77C 'privileg':70B,115C 'rce':39B 'remot':11A,60B,92C,98C 'result':105C 'root':12A 'run':62B,67B 'success':100C 'system':47B,84C,121C 'unauthent':59B,91C,97C 'under':45B,82C,119C 'user':71B,116C 'vulner':78C,104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79872","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79872:188","url":null,"severity":null,"published_at":"2026-10-23T22:14:37+00:00","modified_at":"2026-10-23T22:14:37+00:00","first_seen_at":"2026-10-23T22:14:37+00:00","fetched_at":"2026-10-23T22:14:37+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026, CSAF text) gives affected/fixed versions for the whole bulletin; the text I could read was cut off before this CVE's own entry, so the per-CVE detail (interface, whether it covers AOS-8, AOS-10 or both) is unconfirmed. The CVE record lists 10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13, 8.12.0.0-8.13.3.0 and 8.10.0.0-8.10.0.23 as affected. HPE says it knows of no exploit or public discussion. Not in KEV. VulDB wrongly labels it information disclosure; ignore that."},{"source":"epss","external_id":"CVE-2026-79872","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79872","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1342,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79872","title":"CVE Record: CVE-2026-79872","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}