{"id":"CVE-2026-79879","kind":"vulnerability","aliases":["CVE-2026-79879"],"related":[],"title":"Aruba AOS-10: memory corruption lets adjacent attacker run code as root","description":"Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","summary":"Memory corruption in an unnamed interface of AOS-10 lets an unauthenticated attacker on the same layer 2 segment (adjacent) run code as a privileged user on the controller, gateway or AP OS. CVSS 8.8 (AV:A). Disclosed in HPE bulletin HPESBNW05162. HPE is not aware of public exploit code or discussion.","severity":"high","cvss":8.8,"epss":0.00283,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":"10.8.0.0-10.8.1.1, 10.7.x <= 10.7.2.6, 10.4.x <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adjacent","aos-10","aruba","hpe","infrastructure","network-appliance","wireless"],"not_affected_if":["aos-8-only","no-aos-10-deployment"],"how_to_check":"Run 'show version' on each AOS-10 controller, gateway or AP, or check Central. You are exposed if you run AOS-10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6 or 10.4.x up to 10.4.1.13. EoM trains (10.6, 10.5, 10.3) are presumed affected and get no fix.","fix":"Upgrade to AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later. Until then, restrict CLI and web management to a dedicated L2 segment/VLAN or firewall it at L3 and above (HPE workaround). That only reduces exposure, because the adjacent-network attack path remains.","status":"open","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:43+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-10: memory corruption lets adjacent attacker run code as root","impact":"high","summary":"Aruba AOS-10 network controllers have memory corruption flaws in an affected interface. An unauthenticated attacker on the adjacent network can run arbitrary code as a privileged user on the underlying OS.","category":"infrastructure","who_cares":["aos-10","aruba","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as privileged OS user on the appliance","analyst_note":"Find the affected interface, fixed AOS-10 versions and the vendor advisory from the Aruba security bulletin; the NVD entry gives no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-aos-10-deployment"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000465,"input_tokens":2919,"output_tokens":346,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected interface, fixed AOS-10 versions and the vendor advisory from the Aruba security bulletin; the NVD entry gives no versions.","search":"'-10':3A,20A,23B,39B,92C '-2026':14A,17A '-79879':15A,18A '2':48B '8.8':65B 'adjac':7A,21B,50B,102C 'affect':88C 'allow':107C 'ao':2A,22B,38B,91C 'aos':19A 'ap':62B 'applianc':29B 'arbitrari':112C 'aruba':1A,24B 'attack':8A,43B,103C,109C 'av':66B 'awar':76B 'bulletin':71B 'code':10A,52B,80B,97C,113C 'control':59B 'corrupt':5A,32B,84C 'could':93C,106C 'cve':13A,16A 'cvss':64B 'disclos':68B 'discuss':82B 'execut':98C,111C 'exploit':79B,105C 'gateway':60B 'hpe':25B,70B,73B 'hpesbnw05162':72B 'infrastructur':26B 'interfac':36B,89C 'layer':47B 'lead':94C 'let':6A,40B 'memori':4A,31B,83C 'network':28B 'network-appli':27B 'oper':121C 'os':63B 'privileg':55B,116C 'public':78B 'remot':96C 'root':12A 'run':9A,51B 'segment':49B 'success':104C 'system':122C 'unauthent':42B,101C 'under':120C 'unnam':35B 'user':56B,117C 'vulner':85C 'wireless':30B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79879","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79879:489","url":null,"severity":null,"published_at":"2026-10-23T23:39:45+00:00","modified_at":"2026-10-23T23:39:45+00:00","first_seen_at":"2026-10-23T23:39:45+00:00","fetched_at":"2026-10-23T23:39:45+00:00","note":"Part of HPE bulletin HPESBNW05162 (22 Oct 2026, 72 CVEs). Vendor text read; its Details entry for 79879 was cut off in my fetch, so the interface is unnamed (the advisory only says 'affected interface'). Versions and fix are from the bulletin's common lists plus the CVE record. HPE: no known exploit or public discussion."},{"source":"epss","external_id":"CVE-2026-79879","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79879","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2098,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79879","title":"CVE Record: CVE-2026-79879","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}