Description
A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Published: 2026-10-22
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch
AI Analysis

Impact

The vulnerability describes an authenticated adjacent buffer overflow in the API of AOS-10 that allows an attacker with high privileges to execute arbitrary code on the underlying operating system. Successful exploitation results in remote code execution with privileged user rights. The impact is clear: an authenticated attacker can gain full control over the affected system.

Affected Systems

Hewlett Packard Enterprise systems, likely the AOS-10 product, are affected. Specific product versions are not disclosed in the advisory.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate to high risk. The EPSS score is 0.00184, indicating a very low but nonzero exploit probability, and the vulnerability is not listed in the CISA KEV catalog. The lack of a detailed attack vector suggests that exploitation requires authenticated access, but the ability to execute code remotely is confirmed. The potential for widespread impact depends on the extent of the authenticated access scope within the target environment.

Generated by OpenCVE AI on October 23, 2026 at 21:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest HPE security patch released for the affected AOS‑10 product.
  • Limit or block external access to the network service that processes the input susceptible to the buffer overflow, restricting it to trusted subnets or privileged users.
  • Enable detailed logging around the vulnerable service and review logs for signs of buffer‑overflow attempts or unauthorized code execution.

Generated by OpenCVE AI on October 23, 2026 at 21:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Hpe
Hpe aos
Vendors & Products Hpe
Hpe aos

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description No description provided A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

Fri, 23 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 23 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description No description provided
Title Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-24T03:55:24.769Z

Reserved: 2026-09-22T14:51:55.129Z

Link: CVE-2026-95714

cve-icon Vulnrichment

Updated: 2026-10-23T15:54:53.973Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T19:18:07.453

Modified: 2026-10-26T14:18:54.933

Link: CVE-2026-95714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:10:23Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer