HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
CVE-2026-79872
Unauthenticated buffer overflow RCE in HPE Aruba AOS
- CVSS 3.1
- 9.4 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A buffer overflow in the operating system underlying HPE Aruba AOS lets an unauthenticated remote attacker execute arbitrary code as a privileged user, with no user interaction required. Related reporting ties the issue to AOS-8 and SSH authentication bypass that can lead to system takeover. Affected and fixed versions are not stated.
What to do: Apply HPE's update for CVE-2026-79872. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| HPE Aruba AOS | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L