The issue in one paragraph
HPE has disclosed CVE-2026-79865, a critical memory-corruption vulnerability in ArubaOS AOS-10. An unauthenticated attacker on an adjacent network could potentially cause memory corruption and execute code as a privileged user on the underlying operating system. HPE provides fixed releases for the affected 10.8, 10.7, and 10.4 branches. The organization's decision is not whether the vulnerability sounds serious; it is which systems are affected, how easily they can be reached, and how quickly the fixed image can be installed.
What is known
HPE rates the issue 9.6 Critical with CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. NVD associates it with CWE-119. The vendor lists affected ranges from 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6, and 10.4.0.0 through 10.4.1.13. The fixed releases are 10.8.1.2, 10.7.2.7, and 10.4.1.14 or later in those branches.
The advisory covers Mobility Conductors, Mobility Controllers, Mobility Gateways, and AOS-10 access points. It does not name the affected interface, and HPE says it was not aware of public discussion or exploit code as of the release date. Those limits matter when leaders ask whether an exploit is circulating or which precise service should be scanned.
Why the board should care
The vulnerable software can sit in the network control plane rather than on an isolated end-user device. A successful attack could affect authentication, roaming, configuration integrity, and connectivity for dependent users and sites. The risk is not limited to the confidentiality of one server.
Adjacent access may sound narrow, but shared campus networks, guest Wi-Fi, partner links, and temporary event infrastructure can create the required position. A system described as internal is not automatically separated from lower-trust networks.
The first measurable question
Ask for the number of AOS-10 devices in each affected branch, the number on a fixed release, and the number whose exact version is unknown. Then ask how many of the affected or unknown devices can be reached from a lower-trust adjacent network.
That set is more actionable than a raw product count. ZoomEye Search for app="ArubaOS" returned 213 product-fingerprint matches on 2026-11-09, while the CVE Filter returned 0. The Search count describes product presence, not confirmed vulnerable systems. It can reveal forgotten infrastructure, but it cannot answer the version question.
The first control decision
Install the applicable HPE fixed release where possible. For systems that cannot be patched immediately, restrict CLI and web management interfaces to a dedicated Layer 2 segment or VLAN, enforce firewall policy at Layer 3 and above, and retain accounting records. Those controls lower reachability while the patch program proceeds.
The workaround should not be reported as a complete fix. It reduces the chance that a lower-trust system can reach a vulnerable interface, but the vulnerable code remains until the software is updated.
What could change the risk view
New evidence of public exploitation, a confirmed compromise in a peer environment, or a change in network reachability would raise urgency. A vendor clarification naming the affected interface could sharpen detection and exposure testing. Local evidence of unowned or unpatchable AOS-10 systems would also change the operating picture.
A quiet vendor statement about exploit code does not lower the score by itself. It describes the public exploitation status at the advisory date, not the future state of the threat.
Decisions to request
Request a named owner for the AOS-10 patch program, a risk-ordered rollout list, and a date for every high-exposure device. Request an exception list that includes the exact version, compensating control, accountable owner, and expiration date. Request confirmation that the active image, not just the upgrade job, was verified.
For the highest-risk sites, ask whether management and control paths can be isolated before the maintenance window. For sites awaiting a window, ask what prevents guest or partner traffic from reaching infrastructure interfaces today.
Reporting language that remains accurate
A defensible executive statement is: "CVE-2026-79865 is a critical adjacent-network memory-corruption flaw in AOS-10. The vendor provides fixed releases. We are inventorying affected branches, prioritizing systems reachable from lower-trust networks, and applying management-plane restrictions where patching is delayed. No public exploit code was known to the vendor at release, and we have not described product-search matches as confirmed vulnerable devices."
That statement gives leaders a decision path without turning an exposure estimate into an incident claim. It also keeps the focus on the two actions that matter: install the fixed release and reduce reachability while that work is incomplete.