---
id: "CVE-2026-79879"
kind: "vulnerability"
aliases: ["CVE-2026-79879"]
title: "Aruba AOS-10: memory corruption lets adjacent attacker run code as root"
severity: "high"
cvss: 8.8
epss: 0.00283
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": "10.8.0.0-10.8.1.1, 10.7.x <= 10.7.2.6, 10.4.x <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adjacent", "aos-10", "aruba", "hpe", "infrastructure", "network-appliance", "wireless"]
not_affected_if: ["aos-8-only", "no-aos-10-deployment"]
published_at: "2026-10-22T19:18:00+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79879", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:39:45+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79879", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-10: memory corruption lets adjacent attacker run code as root

Memory corruption in an unnamed interface of AOS-10 lets an unauthenticated attacker on the same layer 2 segment (adjacent) run code as a privileged user on the controller, gateway or AP OS. CVSS 8.8 (AV:A). Disclosed in HPE bulletin HPESBNW05162. HPE is not aware of public exploit code or discussion.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected 10.8.0.0-10.8.1.1, 10.7.x <= 10.7.2.6, 10.4.x <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Run 'show version' on each AOS-10 controller, gateway or AP, or check Central. You are exposed if you run AOS-10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6 or 10.4.x up to 10.4.1.13. EoM trains (10.6, 10.5, 10.3) are presumed affected and get no fix.

## Fix

Upgrade to AOS-10 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later. Until then, restrict CLI and web management to a dedicated L2 segment/VLAN or firewall it at L3 and above (HPE workaround). That only reduces exposure, because the adjacent-network attack path remains.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79879
- 2026-10-23T23:39:45+00:00 analyst — Part of HPE bulletin HPESBNW05162 (22 Oct 2026, 72 CVEs). Vendor text read; its Details entry for 79879 was cut off in my fetch, so the interface is unnamed (the advisory only says 'affected interface'). Versions and fix are from the bulletin's common lists plus the CVE record. HPE: no known exploit or public discussion.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79879

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] CVE Record: CVE-2026-79879 https://www.cve.org/CVERecord?id=CVE-2026-79879

## From the sources

Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_