Aruba AOS-S EUVD-2026-93979

Exploitation requires network adjacency: the attacker must be positioned on the same Layer-2 / adjacent network segment as the affected AOS-S switch (AV:A), such as a directly connected device, a compromised host on the same VLAN/broadcast domain, or an attacker who has already breached the local network - it is NOT exploitable from an arbitrary remote internet host. Within that position, no authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so default-configured, unpatched AOS-S switches are exploitable by sending crafted traffic to the vulnerable handler. The primary limiting factor is therefore physical/logical network access to the switch's segment; segmentation of management/control traffic and restricting untrusted devices on switch-adjacent VLANs meaningfully reduce exposure.

This is a genuinely high-priority vulnerability, not a CVSS-inflated paper risk. The CVSS:3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 9.6) describes unauthenticated, low-complexity, no-interaction memory corruption yielding arbitrary code execution with a scope change on AOS-S (HPE Aruba Networking switch firmware). The one tempering factor is AV:A (adjacent), not AV:N: the attacker must have a foothold on the same Layer-2 broadcast/adjacent network segment as the target switch rather than reaching it across the open internet, which materially narrows the attacker population to insiders, compromised hosts on the LAN, or attackers who have already breached the perimeter. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization yet; these signals are absent (not confirmed negative), meaning exploitation probability cannot be quantified from the input. Net: the technical impact and ease (code execution on core network infrastructure with no auth and no user interaction) make this a priority to patch quickly, but the adjacent-only vector and lack of exploitation signals argue it is a serious internal/lateral-movement risk rather than an internet-wide mass-exploitation event.

An attacker with a presence on the same local/adjacent network segment as an AOS-S switch (for example via a compromised endpoint or rogue device plugged into the LAN) sends crafted packets to the switch's management or protocol handling code, triggering a buffer overflow / memory corruption condition. Because no authentication or user interaction is required (PR:N/UI:N, AC:L), successful exploitation yields arbitrary code execution on the switch, giving the attacker control of core network infrastructure. No public exploit is identified at time of analysis.