{"id":"CVE-2026-95720","kind":"vulnerability","aliases":["CVE-2026-95720"],"related":[],"title":"AOS-8: buffer overflow lets an admin crash the system","description":"A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.","summary":"A buffer overflow in AOS-8, the operating system on Aruba network controllers, can be triggered by an authenticated attacker with administrative access. Successful exploitation crashes the device, which then does not reboot without manual intervention and disrupts network operations.","severity":"medium","cvss":4.4,"epss":0.00108,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aos-8","infrastructure","network-controllers"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-22T19:18:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:35:42+00:00","updated_at":"2026-10-25T04:35:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:35:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-8: buffer overflow lets an admin crash the system","impact":"low","summary":"A buffer overflow in AOS-8, the operating system on Aruba network controllers, can be triggered by an authenticated attacker with administrative access. Successful exploitation crashes the device, which then does not reboot without manual intervention and disrupts network operations.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","network-controllers"],"confidence":0.6,"needs_auth":"yes","worst_case":"Device crashes and stays down until someone intervenes manually","analyst_note":"Check the NVD entry and the vendor advisory for affected AOS-8 versions and the patched release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000503,"input_tokens":3348,"output_tokens":336,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-8':2A,18B,28B,70C '-95720':13A,16A 'access':45B,79C 'admin':7A 'administr':44B,78C 'allow':73C,88C 'ao':1A,17B,27B,69C 'aruba':33B 'attack':42B,76C,90C 'authent':41B,75C 'buffer':3A,24B,64C 'caus':81C 'control':22B,35B 'could':72C,87C 'crash':8A,48B,92C 'cve':11A,14A 'denial':82C 'devic':50B 'disrupt':60B,103C 'exist':67C 'exploit':47B,86C 'infrastructur':19B 'intervent':58B,101C 'let':5A 'manual':57B,100C 'network':21B,34B,61B,104C 'network-control':20B 'oper':30B,62B,105C 'overflow':4A,25B,65C 'prevent':95C 'reboot':55B,98C 'servic':84C 'success':46B,85C 'system':10A,31B,94C 'trigger':38B 'vulner':66C 'without':56B,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95720","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95720","severity":null,"published_at":"2026-10-22T19:18:08+00:00","modified_at":"2026-10-23T20:17:31+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-95720","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95720","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}