Live › vulnerability › CVE-2026-79888
Go to dashboardUnauthenticated buffer overflow (CWE-119) in a web interface endpoint of HPE Networking AOS-8, leading to OS command execution. CVSS 8.1 (AC:H). Fixed in the 22 Oct 2026 HPE bulletin; no known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running HPE/Aruba AOS-8 Mobility Conductors, Controllers, Gateways or Instant APs on 8.10.0.0-8.10.0.23 or 8.12.0.0-8.13.3.0, where the web management interface is reachable by an attacker. Exploitation is rated high-complexity. Devices with management limited to a trusted network are less exposed; AOS-10-only deployments are not covered by this CVE.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-8 | vendor | >= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0 | 8.10.0.24, 8.13.3.1 |
show version and compare to affected ranges: AOS-8.10.0.0-8.10.0.23 and AOS-8.12.0.0-8.13.3.08.13.3.1 (8.12/8.13 branch) or 8.10.0.24 (8.10 branch), per secondary reports of HPE bulletin HPESBNW05162; confirm against the HPE pageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-79888")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.