Description
Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
Published: 2026-10-22
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability involves multiple unauthenticated buffer overflows in web interface endpoints of AOS‑8 devices. By sending specially crafted requests, an attacker can trigger a buffer overflow that enables execution of arbitrary commands on the device's underlying operating system, potentially leading to complete system compromise.

Affected Systems

Hewlett Packard Enterprise's ArubaOS (AOS) 8 Web Interface. The vendor lists the product as ArubaOS (AOS).

Risk and Exploitability

The vulnerability receives a CVSS score of 8.1, indicating high severity. The EPSS score is 0.00238, indicating a low but non-zero exploitation probability, and it is not listed in the CISA KEV catalog. Because the flaws are unauthenticated and target a web interface, the likely attack vector is remote over the network; an attacker could craft malicious requests to trigger the buffer overflows and execute code with the privileges of the web service.

Generated by OpenCVE AI on October 23, 2026 at 21:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Hewlett Packard Enterprise patch or firmware update that addresses the buffer overflow vulnerabilities in the AOS‑8 Web Interface.
  • Restrict external network exposure of the AOS‑8 Web Interface by configuring firewalls or network segmentation to limit access to trusted hosts only.
  • Enable detailed logging on the web interface and monitor for anomalous traffic patterns or repeated malformed requests that could indicate exploitation attempts.

Generated by OpenCVE AI on October 23, 2026 at 21:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Hpe
Hpe aos
Vendors & Products Hpe
Hpe aos

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description No description provided Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.

Fri, 23 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description No description provided
Title Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hpe Aos
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-24T03:55:53.621Z

Reserved: 2026-08-25T14:48:24.898Z

Link: CVE-2026-79889

cve-icon Vulnrichment

Updated: 2026-10-23T19:06:11.158Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T19:18:01.457

Modified: 2026-10-26T14:18:54.933

Link: CVE-2026-79889

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:11:01Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer