EUVD-2026-93978
GHSA-5mpc-p2jf-4mh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AOS-S network interface
-
DeliverySend oversized crafted request
-
ExploitOverflow buffer in parser
-
ExecutionHijack execution flow
-
PersistExecute arbitrary code on switch
-
ImpactPivot across network fabric
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets a network-facing interface of AOS-S (HPE Aruba ArubaOS-Switch firmware); per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special attacker position is required against a reachable switch. The practical limiting factor is network reachability to the specific affected interface - on a well-segmented management network the exposed attack surface is reduced. Note a data gap: the advisory text only references 'the affected interface' without naming the exact service, port, protocol, or configuration mode, so the precise prerequisite feature cannot be confirmed from the provided data and should be verified against HPE bulletin hpesbnw05156en_us; affected and fixed firmware versions were also not supplied. |
| Impact | All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction and full C/I/A impact (9.8 Critical), and the description confirms the end result is arbitrary code execution - the most severe outcome for a network switch operating system. This is the classic profile of a mass-exploitable RCE in network infrastructure. However, several exploitation-maturity signals are MISSING rather than negative: no EPSS probability was supplied, the CVE is not listed in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The absence of these signals does not lower the intrinsic risk - AOS-S switches are internet- and management-network-exposed infrastructure where a pre-auth buffer overflow is highly attractive to attackers. One data gap worth flagging: the description only says a buffer overflow exists 'in the affected interface of AOS-S' without naming the specific service, port, or feature, so defenders cannot yet scope exposure precisely from this data alone - the exact affected interface should be verified against HPE bulletin hpesbnw05156en_us. |
| Exploit ScenarioDerived | An attacker with network reachability to an AOS-S switch's affected interface sends a crafted, oversized request that overflows a buffer in the parsing code, corrupting memory and redirecting execution to attacker-controlled instructions, yielding arbitrary code execution on the switch without any credentials or user interaction. Given AV:N/AC:L/PR:N, this requires only a single network path to the vulnerable service. No public exploit code is referenced at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated remote code execution affects the AOS-S switch firmware line from HPE Aruba, where a buffer overflow in a network-facing interface can be triggered by a remote attacker without credentials, user interaction, or a privileged network position (CVSS 9.8, AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity, and availability impact). The practical barrier to exploitation is reachability of the specific affected interface on the switch rather than any authentication control, so switches whose management or service interfaces are exposed beyond a segmented management network carry the highest risk. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the advisory does not name the vulnerable service, port, protocol, or the affected and fixed firmware versions, so defenders must confirm exposure against HPE bulletin hpesbnw05156en_us.
RemediationAI
No vendor-released patch version was included in the provided data, so the first action is to open HPE bulletin hpesbnw05156en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US) and identify the exact remediated AOS-S firmware build for each affected switch, then schedule that upgrade; because the flaw is reachable pre-authentication over the network, remediation should be treated as urgent rather than batched into a routine maintenance window. Until the fixed firmware is applied, the effective compensating control is reducing reachability of the vulnerable interface: place switch management and all service interfaces behind a dedicated management VLAN with strict ACLs that permit only trusted administrative hosts, and block the affected interface at the network boundary, accepting that this may restrict legitimate remote management and monitoring. Where the vulnerable service is configurable, disable or unbind it if it is not operationally required, and audit switch configurations for any service reachable from untrusted networks, understanding that disabling features can break remote administration or integration tooling. Because neither public exploit code nor confirmed active exploitation was identified at time of analysis, there is no exploit-specific signature guidance available, so monitoring should focus on unexpected inbound traffic to switch service ports and on anomalous device behavior such as unexpected reboots or crashes that can indicate failed exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-S is the switch operating system firmware used across HPE Aruba's switching platforms, and the flaw is a classic memory-safety failure: a buffer overflow in a network-facing interface where input larger than the destination buffer is not adequately bounds-checked, allowing memory corruption that an attacker can steer toward arbitrary code execution. The root-cause class is memory corruption on unvalidated network input (CWE was not supplied in the source data but the vendor tags classify it as a buffer overflow leading to RCE). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U, the vulnerable code path is reachable over the network with no prior authentication and no user interaction, which is characteristic of a pre-authentication parsing or handling routine in a service exposed by the switch. The single authoritative reference is the HPE security bulletin hpesbnw05156en_us; that document is the source of record for the exact interface, protocol, and firmware builds involved, none of which were included in the provided dataset, and it is also where the affected and remediated AOS-S versions must be confirmed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated remote code execution via buffer overflow, giving AV:N/PR:N/UI:N and full C/I/A compromise of the switch; AC:L as no special conditions are stated.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
Executive ViewAI
A critical, unauthenticated remote code execution flaw in HPE Aruba AOS-S switch firmware exposes network switching infrastructure that underpins connectivity for campus, branch, and data-center environments. Any AOS-S switch reachable from an untrusted network - particularly those whose management or service interfaces extend beyond a segmented management VLAN - can be compromised without credentials or user interaction, giving an attacker full control of confidentiality, integrity, and availability on that device. Because no vendor patch is available and the advisory does not name the affected interface or firmware versions, leadership should treat this as an active exposure-management problem requiring immediate reachability review and compensating controls rather than a routine patch cycle item.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly segment and firewall management and service interfaces so AOS-S switches are not reachable from untrusted networks, disable unused services and protocols, restrict administrative access to trusted networks, and monitor switch logs for anomalous activity; apply vendor firmware as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB