Installing a fixed AOS-10 build is a necessary response to CVE-2026-79853, but it is not enough evidence to close the risk. HPE describes a critical unauthenticated information-disclosure issue that could lead to command execution. The post-change review should prove the correct build is running, the management plane is bounded, logging still works, and no unexplained activity remains.
Confirm the release and branch
HPESBNW05162 identifies 10.8.1.2, 10.7.2.7, and 10.4.1.14 as the fixed releases for the respective AOS-10 branches. Read the installed version directly from each device rather than relying on a deployment dashboard. Record the device role, address, branch, build, owner, and change ticket together.
Check standby controllers, remote gateways, and access points that may have been patched outside the main cluster workflow. A partially complete rollout leaves the topic open and can create confusion when the next advisory affects one branch. Treat unsupported devices as a separate risk decision because HPE says deployments past support have not been assessed.
Revalidate the management path
HPE's workaround is to restrict CLI and web management to a dedicated Layer 2 segment or VLAN and enforce firewall policy at Layer 3 and above, with accounting controls. Even after patching, verify that these restrictions reflect the intended design. Look for temporary permit rules, broad any-source management access, unintended IPv6 exposure, and proxy paths that bypass the expected boundary.
Test access from an approved administrative source and from a denied source. Capture the result without leaving persistent test accounts or services. Confirm that management interfaces cannot be reached through guest or user wireless networks. The goal is to show both what works and what is blocked.
Verify accounting and monitoring
Generate a benign administrative action and confirm that it reaches the central collector with time, source, identity, and result. Check configuration-change logging where available. Confirm that the device clock is synchronized so events can be correlated with firewall, VPN, and identity records.
Review the baseline for unexplained accounts, trust relationships, listening services, and recent configuration edits. A clean version check does not erase the possibility that a compromise occurred before the patch. If evidence suggests command execution, isolate the device, preserve records, and use the incident response plan rather than closing the task on the version alone.
Address exposed secrets with evidence
The advisory does not identify the sensitive data exposed by CVE-2026-79853. A risk owner should still understand which secrets and configuration values reside on the device and what would need rotation after a credible exposure. Use incident evidence to sequence that work. Rotating everything without a record makes later verification difficult; rotating nothing assumes the device was never reachable.
Document the decision for each asset: no evidence of exposure, suspicion under investigation, or confirmed incident. Include related management systems that trusted the device. Certificates, API credentials, and administrative accounts may belong to different owners, so the response should assign responsibility explicitly.
Record the closure criteria
A defensible closure record contains the fixed build, the management sources allowed, the denied paths tested, the logging destination, the baseline comparison, and any residual risk. It also identifies exceptions with an owner and deadline. If a device could not be patched, record the compensating restriction and the next maintenance opportunity.
The CVSS 3.1 base score is 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so a superficial check is difficult to defend. CVE-2026-79853 warrants an auditable transition from vulnerable and reachable to fixed and controlled. Post-patch assurance provides that record and gives the next review a reliable starting point.