CVE-2026-79872 Raises ArubaOS Patch Priority to the Management Plane
CVE-2026-79872 is a critical buffer overflow in the underlying operating system of HPE Networking ArubaOS. HPE's advisory gives it a CVSS 3.1 base score of 9.4 and states that a remote attacker can trigger it without credentials or user interaction. A successful attack can execute arbitrary code as a privileged user.
Treat affected wireless controllers, gateways, conductors, and access points as management-plane systems with an urgent patch obligation. The vulnerability sits below the control and data-plane functions normally examined during wireless architecture reviews. A compromise at that layer can affect more than a single service process.
Vulnerability overview
HPE published advisory HPESBNW05162 on October 22, 2026. The advisory describes a buffer overflow in the underlying operating system of AOS. The network vector, low attack complexity, no privileges required, and no user interaction produce a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
That vector describes a serious confidentiality and integrity impact and a low availability impact. The scope is unchanged. These values do not reveal whether exploitation corrupts memory in a control process, a host utility, or another component. HPE does not identify the vulnerable interface, the malformed input, or a reliable exploitation sequence.
Mechanism and exploitation conditions
The advisory identifies a buffer overflow in the underlying operating system. Incoming data can exceed a fixed-size buffer, creating the possibility of memory corruption. Because the CVSS vector is network reachable and requires no privileges, an exposed attack surface can be reached before an administrator authenticates to the device.
The missing details matter. HPE does not publish the affected interface, packet format, offset, or proof-of-concept code. Defenders should not infer that the PAPI protocol, the web interface, or any other named service is the entry point. The appropriate conclusion is narrower: a network-reachable parsing path exists, and a crafted input can lead to privileged code execution.
Impact
A privileged execution primitive on an ArubaOS host can affect the confidentiality and integrity of wireless infrastructure. Possible consequences include access to sensitive configuration and management data, unauthorized changes, disruption of services, and a foothold for further network activity. The CVSS availability rating is low, so outage should not be treated as the only relevant outcome.
Wireless controllers and gateways often occupy a central position in network operations. Their management plane can hold credentials, policy, topology, and device inventory. An attacker who reaches the host operating system may be able to influence functions that extend beyond one wireless client session. This is a risk statement based on the stated impact, not evidence that any specific organization has been compromised.
Affected products and scope
HPE lists the following affected ArubaOS release families:
- AOS-10.8.x through 10.8.1.1
- AOS-10.7.x through 10.7.2.6
- AOS-10.4.x through 10.4.1.13
- AOS-8.13.x through 8.13.3.0
- AOS-8.10.x through 8.10.0.23
The affected product scope includes Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 Access Points, and AOS-8 Instant Access Points. HPE says products outside the listed scope are not affected unless a later advisory changes that statement. End-of-maintenance versions are presumed affected unless explicitly excluded, while end-of-support versions have not been assessed.
Exposure context
A ZoomEye Search for app="ArubaOS" returned 212 product matches at the time of this review. A separate Filter for vul.cve="CVE-2026-79872" returned 0. The 212 figure is a broad product-fingerprint count, not a count of vulnerable devices. It indicates that internet-visible ArubaOS fingerprints can be found, but it cannot establish patch level, exposure of the vulnerable path, or exploitability.
Remediation and mitigations
HPE provides fixed releases for each affected branch: AOS-10.8.1.2, AOS-10.7.2.7, AOS-10.4.1.14, AOS-8.13.3.1, and AOS-8.10.0.24. Administrators should confirm the exact branch deployed on every controller, gateway, conductor, and affected access point before scheduling the upgrade.
Until a supported release is running, HPE recommends restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN and controlling access with Layer 3 and higher firewall policy. Accounting controls should track and log user activity and resource use. These controls reduce reachability and improve accountability, but they do not repair the overflow. HPE states that it was not aware of public discussion or exploit code at the release date; that status can change.
After patching, verify the running version on each device, confirm management access rules still work as intended, review administrative changes made during the exposure window, and keep the management plane separated from general user networks.
