{"id":"CVE-2026-79891","kind":"vulnerability","aliases":["CVE-2026-79891"],"related":[],"title":"AOS-8 CLI buffer overflow lets unauthenticated remote attackers run host commands","description":"A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.","summary":"Buffer overflow in the AOS-8 CLI lets an unauthenticated remote attacker run commands as a privileged user on the host if preconditions outside their control are met (CVSS 8.1, AC:H). Part of HPE bulletin HPESBNW05162 (72 CVEs). No known exploitation or public PoC as of 2026-10-22; fixed in 8.13.3.1 and 8.10.0.24.","severity":"high","cvss":8.1,"epss":0.00255,"exploited":false,"exploited_at":null,"products":[{"name":"ArubaOS AOS-8 (8.13.x)","fixed":["8.13.3.1"],"affected":"<= 8.13.3.0","ecosystem":"vendor"},{"name":"ArubaOS AOS-8 (8.10.x)","fixed":["8.10.0.24"],"affected":"<= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","hpe","infrastructure","mobility-controller","network-infrastructure","wireless"],"not_affected_if":["aos-10-only","management-interface-restricted"],"how_to_check":"On each Mobility Conductor, Controller, Gateway or Instant AP, run 'show version' and compare with: affected if 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. Branches 8.12 and earlier are EoM/EoS and should be treated as potentially affected. Also check whether CLI (SSH/telnet) and management interfaces are reachable from untrusted networks.","fix":"Upgrade AOS-8 to 8.13.3.1 (8.13 branch) or 8.10.0.24 (8.10 branch) or later; download from networkingsupport.hpe.com. Interim: restrict CLI and web management interfaces to a dedicated layer 2 VLAN and/or firewall policy.","status":"open","published_at":"2026-10-22T19:18:01+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:05:45+00:00","updated_at":"2026-10-25T03:18:40+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T03:05:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8 CLI buffer overflow lets unauthenticated remote attackers run host commands","impact":"high","summary":"A buffer overflow in the command line interface of AOS-8 lets an unauthenticated remote attacker run arbitrary commands on the underlying host when certain preconditions outside the attacker's control are met. Successful exploitation gives code execution as a privileged user on the operating system, which leads to full system compromise.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","network-infrastructure"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated remote attacker runs arbitrary commands as privileged user","analyst_note":"Find the vendor advisory and NVD page for CVE-2026-79891 to get affected AOS-8 versions, the preconditions, and the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"AOS-8 deployments with the command line interface reachable by a remote attacker. The sources do not name affected AOS-8 versions or the exact preconditions, so teams running AOS-8 should confirm their exposure with the vendor advisory. unknown for the rest.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000575,"input_tokens":3382,"output_tokens":473,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and NVD page for CVE-2026-79891 to get affected AOS-8 versions, the preconditions, and the fixed release.","search":"'-10':89B '-2026':14A,17A '-22':90B '-79891':15A,18A '-8':2A,21A,26A,30B,46B,108C '2026':88B '72':78B '8.1':70B '8.10':27A '8.10.0.24':95B '8.13':22A '8.13.3.1':93B 'ac':71B 'allow':111C,138C 'ao':1A,29B,45B,107C 'aos':20A,25A 'arbitrari':118C,143C 'aruba':31B 'arubaos':19A,24A 'attack':9A,52B,115C,130C,140C 'buffer':4A,41B,97C 'bulletin':76B 'certain':125C 'cli':3A,47B 'code':144C 'command':12A,54B,103C,119C 'complet':156C 'compromis':158C 'control':36B,66B,132C 'could':110C,137C 'cve':13A,16A 'cves':79B 'cvss':69B 'execut':142C 'exist':100C 'exploit':82B,136C 'fix':91B 'h':72B 'host':11A,61B,123C 'hpe':32B,75B 'hpesbnw05162':77B 'infrastructur':33B,39B 'interfac':105C 'known':81B 'lead':154C 'let':6A,48B 'line':104C 'met':68B,134C 'mobil':35B 'mobility-control':34B 'network':38B 'network-infrastructur':37B 'oper':152C 'outsid':64B,127C 'overflow':5A,42B,98C 'part':73B 'poc':85B 'precondit':63B,126C 'privileg':57B,147C 'public':84B 'remot':8A,51B,114C 'run':10A,53B,117C 'success':135C 'system':153C,157C 'unauthent':7A,50B,113C 'under':122C,151C 'user':58B,148C 'vulner':99C 'wireless':40B 'x':23A,28A","nicknames":[],"mitigations":[],"who_affected":"Anyone running HPE/Aruba AOS-8 on Mobility Conductors, Mobility Controllers or Instant APs on 8.13.3.0 or older (8.13) or 8.10.0.23 or older (8.10). Risk is highest where the CLI or management plane is reachable from untrusted networks. Teams on AOS-10 only, or with management restricted to a dedicated VLAN/firewall, have lower exposure but should still patch.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:18:40Z","by":"analyst","run_id":689},"products":{"at":"2026-10-25T03:18:40Z","by":"analyst","run_id":689},"workarounds":{"at":"2026-10-25T03:18:40Z","by":"analyst","run_id":689}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79891","severity":null,"published_at":"2026-10-22T19:18:01+00:00","modified_at":"2026-10-23T20:17:26+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79891","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79891","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79891:689","url":null,"severity":null,"published_at":"2026-10-25T03:18:40+00:00","modified_at":"2026-10-25T03:18:40+00:00","first_seen_at":"2026-10-25T03:18:40+00:00","fetched_at":"2026-10-25T03:18:40+00:00","note":"Read HPE bulletin HPESBNW05162 (signed text, 2026-Oct-22): AOS-8 8.13.x<=8.13.3.0 and 8.10.x<=8.10.0.23 affected; fixed 8.13.3.1 / 8.10.0.24. HPE says no known public discussion or exploit; CISA SSVC exploitation none. Per-CVE details section was truncated in my read, so the exact preconditions are unknown (HPE only says 'outside attacker's control', AC:H). Not marked verified: how_to_check, who_affected."}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3110,"url":"https://db.gcve.eu/vuln/cve-2026-79891","title":"CVE-2026-79891 CVE record (CNA hpe)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}