HPE Warns of Critical Buffer Overflow in AOS-10 and AOS-8 Products

HPE published advisory HPESBNW05162 on October 22, 2026, describing CVE-2026-79863, a buffer overflow in an affected interface of AOS-10 and AOS-8 products. The flaw can let an unauthenticated adjacent attacker send crafted data and potentially run code as a privileged user on the underlying operating system. It carries a CVSS 3.1 score of 9.6, rated Critical, and the advisory does not disclose the exact interface or exploit packet format. HPE lists fixed releases across several branches and names affected products including Mobility Conductors, Controllers, Gateways and access points. The article stresses that applying an update is not enough, and that operators should verify running versions on each device, including redundant peers, and test network boundaries.