Description
A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.
Published: 2026-10-22
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability remains an authenticated local buffer overflow that can cause the AOS‑8 system to crash, resulting in denial of service. The updated description confirms this impact without adding new exploitation details.

Affected Systems

Hewlett Packard Enterprise, product AOS‑8. The affected product list does not specify sub‑products; any HPE AOS‑8 deployment requiring local authentication may be impacted.

Risk and Exploitability

The CVSS score of 4.4 indicates moderate severity. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. The vulnerability requires authenticated local access, limiting exploitation to local users or attackers with administrative privileges. The vulnerability is not listed in the CISA KEV catalog. Due to the lack of detailed information, the exact exploitability conditions remain unclear.

Generated by OpenCVE AI on October 23, 2026 at 21:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent HPE AOS‑8 patch or firmware update that addresses the buffer overflow issue.
  • If a timely patch is not available, restrict local administrative access to trusted personnel only and disable any components that may invoke the vulnerable code path.
  • Monitor the AOS‑8 system for abnormal service crashes or restarts and set up alerting for intermittent denial‑of‑service events.

Generated by OpenCVE AI on October 23, 2026 at 21:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Hpe
Hpe aos
Vendors & Products Hpe
Hpe aos

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Description No description provided A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

Fri, 23 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
CWE-122

Fri, 23 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Fri, 23 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
CWE-122

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description No description provided
Title Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Hpe Aos
cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2026-10-23T19:14:23.808Z

Reserved: 2026-09-22T14:51:55.130Z

Link: CVE-2026-95720

cve-icon Vulnrichment

Updated: 2026-10-23T15:18:26.182Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T19:18:08.620

Modified: 2026-10-26T14:18:54.933

Link: CVE-2026-95720

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:10:07Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer