Live › vulnerability › CVE-2026-79891
Go to dashboardBuffer overflow in the AOS-8 CLI lets an unauthenticated remote attacker run commands as a privileged user on the host if preconditions outside their control are met (CVSS 8.1, AC:H). Part of HPE bulletin HPESBNW05162 (72 CVEs). No known exploitation or public PoC as of 2026-10-22; fixed in 8.13.3.1 and 8.10.0.24.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running HPE/Aruba AOS-8 on Mobility Conductors, Mobility Controllers or Instant APs on 8.13.3.0 or older (8.13) or 8.10.0.23 or older (8.10). Risk is highest where the CLI or management plane is reachable from untrusted networks. Teams on AOS-10 only, or with management restricted to a dedicated VLAN/firewall, have lower exposure but should still patch.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ArubaOS AOS-8 (8.13.x) | vendor | <= 8.13.3.0 | 8.13.3.1 |
| ArubaOS AOS-8 (8.10.x) | vendor | <= 8.10.0.23 | 8.10.0.24 |
show version and compare with: affected if 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.238.13.3.1 (8.13 branch) or 8.10.0.24 (8.10 branch) or later; download from networkingsupport.hpe.comEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-79891")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.