A patch ticket can report success while the device is still running the old image. That risk is especially relevant when a controller manages many access points, a gateway participates in a cluster or a maintenance window ends before every role is checked.
CVE-2026-79851 requires a verified fixed release because HPE describes an unauthenticated buffer overflow that can execute code as a privileged user. The CVE record assigns CVSS 3.1 10.0. Completion therefore needs evidence, not a successful download message.
Before the change
Record the serial number, role, site, high-availability peer, current image, management addresses and owner. Confirm that the current release falls in an affected AOS-10 range.
The affected ranges are 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6 and 10.4.0.0 through 10.4.1.13. Fixed releases are 10.8.1.2, 10.7.2.7 and 10.4.1.14.
Capture the approved configuration and current management path. Check the vendor support matrix for the hardware and the release. Review the rest of HPESBNW05162 so that the change covers other applicable fixes without assuming they are all resolved by one branch update.
Confirm the target image
Write the exact target string into the change record. Do not use a family label such as AOS-10 as a target version. The three affected branches have different fixed releases.
For a mixed estate, create a mapping from every device to its target image. A 10.8 controller, a 10.7 gateway and a 10.4 access point should not receive the same generic instruction.
Apply the interim control
If any device remains on an affected release after the first maintenance window, restrict CLI and web management access to a dedicated Layer 2 segment or VLAN and enforce Layer 3 firewall policy. Enable accounting for administrative activity.
Test the control from an unapproved source and verify both IPv4 and IPv6. A documented rule that does not block the tested path is not a completed mitigation.
Upgrade and inspect health
Follow the vendor procedure for the device role. In a high-availability pair, use the documented order and confirm that the peer relationship is healthy before moving to the next node.
After the reboot, inspect controller or conductor status, access point adoption, gateway tunnels, routing and service integrations. A device can return to management while a dependent service remains degraded.
Prove the live image
Query the running image directly. Store the command output or management-platform evidence with the change record. Do not use the presence of an image file, a scheduled job or a reboot timestamp as the only proof.
If the live query fails, mark the device unverified. Do not infer success from neighboring devices on the same branch.
Recheck the management path
Confirm that the approved administrative path still works and that broad or temporary access remains blocked. Review firewall policy and device configuration after the upgrade. Maintenance activity can restore a temporary rule or expose an interface that was previously restricted.
Check that accounting and log forwarding still work. Preserve records from before the upgrade long enough to investigate the exposure window.
Review for signs of compromise
HPE did not report known public exploit code at the advisory release, but that does not remove the need to review activity from the vulnerable period. Compare configuration with the approved baseline and inspect management access, restarts and unexpected outbound connections.
Use the review to identify leads. The advisory does not provide an exploit signature, so a clean search for one guessed request string is not proof of safety.
Exposure context
A ZoomEye Search for app="ArubaOS" returned 212 product-fingerprint matches. The CVE Filter returned 0. The count can support external discovery, but patch completion depends on the internal live image and management-path evidence.
Close the task
The CVE-2026-79851 task is complete when every in-scope device has a verified fixed image, the management path matches the approved design and logs are available for review. Devices with unknown versions or failed verification need an owner and a dated follow-up.