---
id: "CVE-2026-95720"
kind: "vulnerability"
aliases: ["CVE-2026-95720"]
title: "AOS-8: buffer overflow lets an admin crash the system"
severity: "medium"
cvss: 4.4
epss: 0.00108
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aos-8", "infrastructure", "network-controllers"]
not_affected_if: []
published_at: "2026-10-22T19:18:08+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:35:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95720", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95720", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# AOS-8: buffer overflow lets an admin crash the system

A buffer overflow in AOS-8, the operating system on Aruba network controllers, can be triggered by an authenticated attacker with administrative access. Successful exploitation crashes the device, which then does not reboot without manual intervention and disrupts network operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95720
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95720

## From the sources

A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_