{"id":"CVE-2026-79888","kind":"vulnerability","aliases":["CVE-2026-79888"],"related":[],"title":"AOS-8 web interface buffer overflow lets unauthenticated attackers run OS commands","description":"A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.","summary":"Unauthenticated buffer overflow (CWE-119) in a web interface endpoint of HPE Networking AOS-8, leading to OS command execution. CVSS 8.1 (AC:H). Fixed in the 22 Oct 2026 HPE bulletin; no known exploitation.","severity":"high","cvss":8.1,"epss":0.00238,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.10.0.24","8.13.3.1"],"affected":">= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","hpe","infrastructure","network-devices","rce","unauthenticated","web-interface"],"not_affected_if":["unknown"],"how_to_check":"On the Mobility Conductor/Controller or Instant AP, run 'show version' and compare to affected ranges: AOS-8.10.0.0-8.10.0.23 and AOS-8.12.0.0-8.13.3.0. Restrict the web management interface to a trusted management network.","fix":"Upgrade AOS-8 to 8.13.3.1 (8.12/8.13 branch) or 8.10.0.24 (8.10 branch), per secondary reports of HPE bulletin HPESBNW05162; confirm against the HPE page. EoM/EoS releases are affected and not patched.","status":"open","published_at":"2026-10-22T19:18:01+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:05:49+00:00","updated_at":"2026-10-25T03:18:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:05:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8 web interface buffer overflow lets unauthenticated attackers run OS commands","impact":"high","summary":"A buffer overflow in a web interface endpoint of AOS-8 devices can be triggered by an unauthenticated remote attacker. Successful exploitation can run arbitrary commands on the underlying operating system, leading to full device compromise.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","network-devices","web-interface"],"confidence":0.55,"needs_auth":"no","worst_case":"Arbitrary commands run on the device OS, full system compromise","analyst_note":"Find the vendor advisory for CVE-2026-79888 to get affected AOS-8 versions, fixed releases and whether the endpoint is exposed by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"AOS-8 network devices with the affected web interface endpoint exposed to the attacker's network. The sources do not list affected versions or configuration conditions, so teams running AOS-8 should treat themselves as potentially exposed until the vendor advisory is checked.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000561,"input_tokens":3357,"output_tokens":450,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-79888 to get affected AOS-8 versions, fixed releases and whether the endpoint is exposed by default.","search":"'-119':38B '-2026':14A,17A '-79888':15A,18A '-8':2A,20A,22B,48B,79C '2026':63B '22':61B '8.1':55B 'ac':56B 'allow':82C,95C 'ao':1A,21B,47B,78C 'aos':19A 'arbitrari':100C 'aruba':23B 'attack':9A,86C,97C 'buffer':5A,35B,90C 'bulletin':65B 'certain':73C 'command':12A,52B,101C 'complet':109C 'compromis':111C 'could':81C,94C 'cve':13A,16A 'cvss':54B 'cwe':37B 'devic':28B,80C 'endpoint':43B,76C 'execut':53B,99C 'exploit':68B,93C 'fix':58B 'h':57B 'hpe':24B,45B,64B 'infrastructur':25B 'interfac':4A,33B,42B,75C 'known':67B 'lead':49B,107C 'let':7A 'network':27B,46B 'network-devic':26B 'oct':62B 'oper':105C 'os':11A,51B 'overflow':6A,36B,91C 'rce':29B 'remot':85C 'run':10A 'success':92C 'system':106C,110C 'trigger':88C 'unauthent':8A,30B,34B,84C 'under':104C 'vulner':70C 'web':3A,32B,41B,74C 'web-interfac':31B","nicknames":[],"mitigations":[],"who_affected":"Anyone running HPE/Aruba AOS-8 Mobility Conductors, Controllers, Gateways or Instant APs on 8.10.0.0-8.10.0.23 or 8.12.0.0-8.13.3.0, where the web management interface is reachable by an attacker. Exploitation is rated high-complexity. Devices with management limited to a trusted network are less exposed; AOS-10-only deployments are not covered by this CVE.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79888","severity":null,"published_at":"2026-10-22T19:18:01+00:00","modified_at":"2026-10-23T20:17:26+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79888","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79888","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79888:690","url":null,"severity":null,"published_at":"2026-10-25T03:18:42+00:00","modified_at":"2026-10-25T03:18:42+00:00","first_seen_at":"2026-10-25T03:18:42+00:00","fetched_at":"2026-10-25T03:18:42+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026) covers this CVE; HPE page is JS-only and unreadable here. Affected ranges from CCB Belgium reproduction; fixed releases 8.13.3.1/8.10.0.24 from GBHackers (secondary). No exploitation or PoC known (HPE, CISA SSVC none). Nothing marked verified. Endpoint and default exposure unknown. Settle by reading the HPE bulletin's CVE-2026-79888 entry. Note: NVD/VulDB CWE mismatch (VulDB says CWE-78; CNA says CWE-119)."}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3115,"url":"https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-hpe-networking-aos-patch-immediately","title":"CCB Belgium: Multiple Critical Vulnerabilities in HPE Networking AOS","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1599,"url":"https://gbhackers.com/critical-hpe-aruba-aos-8-flaw/","title":"GBHackers: Critical HPE Aruba AOS-8 flaw","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}