by Kastro
Paper/Archive/CVE-2026-79872

CVE-2026-79872

Hewlett Packard Enterprise (HPE) ArubaOS (AOS) — Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8

EPSS 0.6%CVSS 9.4
critical.is priorityof 100
38
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 46.3.463 × 209.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Affected

ProductAffectedFixed inSource
ArubaOS (AOS)10.8.0.0 – 10.8.1.1–CNA
ArubaOS (AOS)10.7.0.0 – 10.7.2.6–CNA
ArubaOS (AOS)10.4.0.0 – 10.4.1.13–CNA
ArubaOS (AOS)8.13.0.0 – 8.13.3.0–CNA
ArubaOS (AOS)8.10.0.0 – 8.10.0.23–CNA

Scores by source

hpe (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US