HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
Vulnerability1 · 1 read
CVE-2026-79859
Unauthenticated buffer overflow RCE in HPE Aruba AOS-8
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A buffer overflow in an affected interface of HPE Aruba AOS-8 can be triggered remotely without authentication or user interaction. Successful exploitation lets an attacker run arbitrary code as a privileged user on the underlying operating system. Related reporting describes the issue as allowing SSH authentication bypass and system takeover. HPE has not listed affected builds or a fixed release.
What to do: Apply HPE's update for CVE-2026-79859. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| HPE Aruba AOS-8 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H