A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Critical 9.4
CVE-2026-79872
HPE ArubaOS (AOS) — remote code execution.
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker.
WeaknessCWE-121: Stack buffer overflow
Published Updated Source NVD
CVSS 3.1
9.4
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Exploit chance, 30 days
0.6%
Higher than 46% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run HPE ArubaOS (AOS), and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in HPE ArubaOS (AOS)
31 more CVEs
9.3HPE ArubaOS (AOS) — information disclosure.EPSS 0.2%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — information disclosure.EPSS 0.3%