---
id: "CVE-2026-79872"
kind: "vulnerability"
aliases: ["CVE-2026-79872"]
title: "Aruba AOS-10 and AOS-8 controllers: buffer overflow gives remote root code execution"
severity: "critical"
cvss: 9.4
epss: 0.00439
exploited: false
status: "resolved"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": "<= 10.8.1.1; <= 10.7.2.6; <= 10.4.1.13", "ecosystem": "vendor"}, {"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": "<= 8.13.3.0; <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos", "aos-10", "aos-8", "aruba", "buffer-overflow", "hpe", "infrastructure", "network-appliance", "rce"]
not_affected_if: ["unknown"]
published_at: "2026-10-22T19:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79872", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:14:37+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79872", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-10 and AOS-8 controllers: buffer overflow gives remote root code execution

A buffer overflow in the underlying operating system of HPE Aruba AOS-10 and AOS-8 controllers lets an unauthenticated remote attacker run arbitrary code. The code runs as a privileged user on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected <= 10.8.1.1; <= 10.7.2.6; <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14
- vendor:AOS-8 affected <= 8.13.3.0; <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## Fix

Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14; upgrade AOS-8 to 8.13.3.1 or 8.10.0.24, per the affected version ranges listed.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79872
- 2026-10-23T22:14:37+00:00 analyst — HPE bulletin HPESBNW05162 (22 Oct 2026, CSAF text) gives affected/fixed versions for the whole bulletin; the text I could read was cut off before this CVE's own entry, so the per-CVE detail (interface, whether it covers AOS-8, AOS-10 or both) is unconfirmed. The CVE record lists 10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13, 8.12.0.0-8.13.3.0 and 8.10.0.0-8.10.0.23 as affected. HPE says it knows of no exploit or public discussion. Not in KEV. VulDB wrongly labels it information disclosure; ignore that.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79872

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] CVE Record: CVE-2026-79872 https://www.cve.org/CVERecord?id=CVE-2026-79872
- [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_