Version Inventory Lessons from CVE-2026-79863
CVE-2026-79863 affects several ArubaOS branches across access points, controllers and gateways. The wide version range makes a familiar problem visible: an organization can know that it owns ArubaOS without knowing which build is running on each device. A precise inventory is the difference between a targeted patch and a guess.
The advisory baseline
HPE released advisory HPESBNW05162 for CVE-2026-79863 on October 22, 2026. The flaw is a buffer overflow in an affected AOS-10 or AOS-8 interface. An unauthenticated attacker on an adjacent network can potentially execute code as a privileged user through specially crafted data.
The severity is Critical and the CVSS 3.1 score is 9.6. The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CISA's enrichment associates the issue with CWE-120.
Version ranges that need exact comparison
The affected ranges in the vendor advisory are:
- AOS-10.8.x.x through 10.8.1.1
- AOS-10.7.x.x through 10.7.2.6
- AOS-10.4.x.x through 10.4.1.13
- AOS-8.13.x.x through 8.13.3.0
- AOS-8.10.x.x through 8.10.0.23
The corresponding fixed releases are 10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 and 8.10.0.24. A value such as "AOS-8.13" is not enough. The inventory needs the full build string returned by the device or management platform.
The named product classes are Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-10 access points and AOS-8 Instant access points. A controller inventory may be complete while older Instant access points remain unmanaged or recorded under a former site name.
Why unsupported branches matter
HPE says products past end of maintenance are presumed affected unless the advisory explicitly says otherwise. Such systems may not have a supported fixed release. They require a disposition decision: replace, isolate, upgrade to a supported platform or accept a documented operational restriction.
Do not let an end-of-life status remove a device from the list. It changes the remediation route, not the need to identify the system.
Reconcile multiple sources
Management consoles, DHCP records, certificate inventories, procurement systems and network scans can each contain a partial view. Use the device's authenticated version as the authoritative field where possible. Attach the collection time, the collector and confidence.
Look for duplicate hostnames, reused management addresses and virtual appliances that were cloned with stale version data. A scan result that only identifies "ArubaOS" should remain a discovery lead until an owner confirms the branch and patch.
Exposure context
The formal ZoomEye Search app="ArubaOS" returned 210 product-fingerprint matches. The CVE filter returned 0, so the selected Exposure is 210.
This is not a verified vulnerable population. The search index cannot show the exact build or the reachability of the affected interface. It can, however, provide a useful external consistency check when an organization believes its internal inventory is complete.
Remediation records
HPE recommends upgrading to the applicable fixed release and restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN, with firewall control at Layer 3 and above. Add accounting and logging for management activity.
A patch record should contain the device identifier, prior version, target version, build source, change ticket, operator, time and post-install verification. For deferred systems, record the exposure path, compensating controls, owner and next review date.
HPE reported no known public exploit code at advisory release. The inventory and patch record still matter because unauthenticated adjacent code execution is a high-impact condition and the vulnerable branches span several supported product lines.
Top comments (0)