CVE-2026-79863: Reading the CVSS Vector in Operational Terms
A CVSS score summarizes severity, but it does not replace a network assessment. CVE-2026-79863 has a 9.6 base score, and the vector explains why the number is high: the attack is adjacent, unauthenticated and capable of changing the scope while affecting confidentiality, integrity and availability.
The disclosure
HPE published CVE-2026-79863 in advisory HPESBNW05162 on October 22, 2026. The vulnerability is a buffer overflow in an affected interface of AOS-10 or AOS-8. A crafted input from an adjacent attacker can lead to arbitrary code execution with privileged access on the underlying operating system.
The CVSS 3.1 vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The vendor rates the issue Critical. The CVE record carries CWE-120, buffer copy without checking the input size.
Reading the vector
AV:A means the attacker needs an adjacent network position. It does not mean physical proximity or a trusted user account.
AC:L means the attack complexity is assessed as Low. The vendor does not describe a race condition or a precondition outside the attacker's control.
PR:N means no privileges are required. UI:N means no user interaction is required.
S:C means the vulnerable component can affect resources beyond its own security scope. C:H, I:H and A:H mean High confidentiality, integrity and availability impact.
The resulting score deserves priority, but the defender still has to answer the AV:A question. Which networks can reach the affected interface? If the answer is broad, the operational risk is higher. If the path is tightly restricted and monitored, the organization may have more time to schedule a controlled upgrade.
Affected products and versions
HPE lists AOS-10.8.0.0 through 10.8.1.1, AOS-10.7.0.0 through 10.7.2.6, AOS-10.4.0.0 through 10.4.1.13, AOS-8.13.0.0 through 8.13.3.0 and AOS-8.10.0.0 through 8.10.0.23 as affected.
Fixed releases are 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24. The named platforms include Mobility Conductors, Mobility Controllers, Mobility Gateways, AOS-10 access points and AOS-8 Instant access points.
Exposure evidence
ZoomEye Search app="ArubaOS" returned 210 product-fingerprint matches. The Filter vul.cve="CVE-2026-79863" returned 0. The selected Exposure is 210 under the larger successful result rule.
That value is not a confirmed vulnerable count. It does not show the installed release, whether the interface is reachable or whether a matched device is in the same network as an attacker. Use it to identify inventory gaps and to communicate the limits of external measurement.
Turning severity into decisions
An organization can make a defensible decision in four steps:
- Identify every named product and installed branch.
- Test which networks can reach the affected interfaces.
- Apply the fixed release or an approved compensating control.
- Verify the resulting version and network boundary.
HPE recommends a dedicated Layer 2 segment or VLAN for CLI and web management interfaces, with firewall policy at Layer 3 and above. Accounting and logging should record management activity. These controls can reduce the reachable population while the upgrade is scheduled.
HPE reported no known public exploit code at release. The absence of public tooling affects the immediate threat picture, not the vendor's assessment of impact. A critical unauthenticated flaw in wireless infrastructure should remain visible in the risk register until an owner verifies remediation.
Top comments (0)