A successful software upload is not proof that CVE-2026-79863 is fixed. The device may have rolled back, booted from another partition, retained an older image or missed one member of a redundant pair. Remediation needs an authenticated check of the running release and a test of the network boundary that made the flaw reachable.
What needs fixing
HPE published advisory HPESBNW05162 on October 22, 2026. CVE-2026-79863 is a buffer overflow in an affected interface of AOS-10 or AOS-8. An unauthenticated adjacent attacker can send crafted data and potentially execute code as a privileged user on the underlying operating system.
The CVSS 3.1 score is 9.6 and the severity is Critical. The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The CVE record associates the issue with CWE-120. The exact interface and exploit packet format are not disclosed by the advisory.
Fixed releases
HPE lists the following fixed versions:
AOS-10.8.1.2 and above
AOS-10.7.2.7 and above
AOS-10.4.1.14 and above
AOS-8.13.3.1 and above
AOS-8.10.0.24 and above
The affected versions extend through 10.8.1.1, 10.7.2.6, 10.4.1.13, 8.13.3.0 and 8.10.0.23 in those branches. Products named by HPE include Mobility Conductors, Mobility Controllers, Mobility Gateways, AOS-10 access points and AOS-8 Instant access points.
Verify the running image
Collect the version from the running device, not only from the management platform's inventory. Confirm the image source and the active boot partition. Record the result with the device identifier, collection time and operator.
For redundant systems, verify each peer. A controller pair can appear healthy while one member still runs the previous branch. For remote sites, check that the device has returned to normal forwarding and that access points have rejoined before closing the change.
HPE recommends testing compatibility with access-point and gateway dependencies. A version that satisfies the CVE check but breaks wireless service is not a complete operational remediation.
Verify the network boundary
The vendor suggests restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN and controlling access with firewall policy at Layer 3 and above. It also recommends accounting controls for management activity.
Translate that guidance into tests. From each adjacent network class, verify that unauthorized paths are denied. Check the management network, guest network, branch routes, remote-support connections and any temporary paths used during the upgrade. Record the source, destination, protocol, result and date.
Do not assume that a firewall rule is effective because it exists in a repository. Confirm the deployed rule and the route that carries the traffic. If an exception is necessary, give it an owner, a reason and an expiration date.
Evidence and exposure context
ZoomEye Search app="ArubaOS" returned 210 product-fingerprint matches. The CVE-specific filter returned 0. The selected Exposure is 210.
This metric does not prove that any matched system is vulnerable or that a remediated system is safe. It is a broad fingerprint count. Keep it separate from the internal evidence that records the exact installed version and tested reachability.
HPE says it was not aware of public discussion or exploit code at advisory release. Verification is still needed because a critical buffer overflow with an unauthenticated adjacent path can affect wireless controllers and dependent infrastructure.
Closure criteria
Close the vulnerability item only when each affected device has a verified fixed build, each unpatched exception has compensating controls and each exception has an accountable owner. Preserve logs and configuration evidence from the change window.
If compromise is suspected, do not treat patching as cleanup. Isolate the system, collect logs and configuration, review downstream policy and access-point behavior, and compare the state with a trusted baseline. The patch closes the known code path; it does not erase evidence of earlier activity.