CVE-2026-79847

AOS-10 is the software that runs certain business network equipment, like Wi-Fi controllers and gateways. This flaw is like leaving a back door on that equipment unlocked — someone outside could walk in and take full control of the device without ever needing a key or password.

This matters to you if your business uses Aruba network equipment running AOS-10, such as wireless controllers or gateways. The vulnerability requires no login and no action from any user, so the only thing standing between you and risk is whether that equipment is reachable from the public internet.

There is no evidence yet that attackers are exploiting this flaw, and no public exploit code exists, but the vulnerability is rated at the highest possible severity and allows full remote takeover with no login required. Treat this as a priority to track closely and lock down network exposure now, even though it doesn't yet require emergency action.

Inventory all AOS-10 deployments (controllers, gateways, access points) and determine firmware versions in use. No fixed version has been published yet, so monitor Aruba/HPE's security advisory page directly for the patch release tied to CVE-2026-79847. As an interim workaround, ensure management interfaces and AOS-10 services are not exposed to the internet, enforce network segmentation/ACLs limiting access to trusted administrative subnets, and consider disabling any non-essential remote-management features. Once a patch is issued, prioritize deployment given the CVSS 10.0 rating and unauthenticated network attack vector; test in a staging environment if your upgrade path has known breaking changes. Monitor Aruba advisories, CISA KEV listings, and exploit-tracking feeds for any change in exploitation status, as this could escalate quickly if public exploit code or in-the-wild activity emerges.

CVSS 3.1 score 10.0 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction, full compromise of confidentiality, integrity, and availability with scope change. Weakness class is CWE-119 (improper restriction of operations within a memory buffer), consistent with a classic buffer overflow leading to remote code execution. Not listed in CISA's Known Exploited Vulnerabilities catalog, no public exploit code is on record, and no vendor patch has been published at this time. Press attention is newly emerging, which reflects awareness of the disclosure rather than confirmed active exploitation.