A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.
Critical 9.3
CVE-2026-79876
HPE ArubaOS (AOS) — information disclosure.
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.
WeaknessCWE-200: Information disclosure
Published Updated Source NVD
CVSS 3.1
9.3
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Exploit chance, 30 days
0.2%
Higher than 14% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run HPE ArubaOS (AOS), and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in HPE ArubaOS (AOS)
31 more CVEs
9.3HPE ArubaOS (AOS) — authentication bypass.EPSS 0.2%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — information disclosure.EPSS 0.3%