Description
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Published: 2026-10-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated attacker. Successful exploitation would allow execution of arbitrary code with privileged OS access, compromising confidentiality, integrity, and availability of the device and its underlying operating system.

Affected Systems

Hewlett Packard Enterprise devices running ArubaOS (AOS) version 10 are affected. No specific firmware or software version information is disclosed; administrators should consult HPE support documentation for details on impacted components.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that attacker exploitation is unlikely at present, and the vulnerability is not yet listed in the CISA KEV catalog. The flaw involves unauthenticated adjacent memory corruption, and an attacker who can reach the vulnerable interface can trigger the corruption, potentially leading to arbitrary code execution with privileged OS access.

Generated by OpenCVE AI on October 24, 2026 at 00:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available HPE patch or update for AOS-10 that addresses this memory corruption.
  • Restrict network access to AOS-10 devices to trusted hosts or VLANs, and enable firewall rules to block unsolicited traffic.
  • Monitor logs for unusual memory fault or execution patterns, and alert security teams to potential exploitation attempts.

Generated by OpenCVE AI on October 24, 2026 at 00:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Hpe
Hpe aos
Vendors & Products Hpe
Hpe aos

Sat, 24 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787

Fri, 23 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description No description provided Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

Fri, 23 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-787

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description No description provided
Title Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hpe Aos
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-30T19:17:50.418Z

Reserved: 2026-08-25T14:48:16.470Z

Link: CVE-2026-79879

cve-icon Vulnrichment

Updated: 2026-10-30T19:17:23.037Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T19:18:00.380

Modified: 2026-10-30T20:17:18.717

Link: CVE-2026-79879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:24:50Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write