EUVD-2026-93980
GHSA-xjm4-53qx-cfrp
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuine high-priority issue for organizations running HPE Aruba switching infrastructure, but the risk is bounded by the adjacent-network attack vector rather than being internet-wide. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H, 9.3 Critical) is internally consistent with the description: adjacent (AV:A) matches an attacker on the same Layer 2 segment/broadcast domain, no privileges (PR:N) matches 'unauthenticated,' and C:H + A:H matches 'expose sensitive memory contents and cause a denial of service.' The scope-changed (S:C) element is plausible for a switch where a control-plane overflow can affect the broader switched fabric/managed devices, and is the main driver pushing the score to 9.3. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis - the severity here is driven by potential impact, not by evidence of exploitation. The practical limiting factor is that exploitation requires adjacency (not routable internet access), which meaningfully narrows the attacker population to someone already on or bridged into the local network segment. Treat as a priority patch for management/access-layer switches, especially those reachable from untrusted VLANs or user ports, but it is not a drop-everything internet-facing emergency absent exploitation evidence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
An unauthenticated buffer overflow in HPE Aruba AOS-S switch software lets an attacker who already sits on an adjacent Layer 2 network segment read out sensitive memory contents and crash the device, producing a denial of service. The flaw carries a CVSS 3.1 base score of 9.3 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), meaning no credentials or user interaction are needed, but the attacker must be able to reach the switch from an adjacent network rather than across the internet. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is real and high-severity for organizations running Aruba/HPE switching infrastructure yet bounded by the adjacent-network attack vector. The HPE security advisory (hpesbnw05156en_us) is the authoritative source for affected builds and fixed firmware.
RemediationAI
Patch status is not confirmed in the provided data, so the first action is to open the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05156en_us&docLocale=en_US, identify the exact AOS-S firmware revision that resolves the overflow, and schedule that upgrade - no specific fixed version number can be cited here without inventing one. Until a fixed build is running, the effective mitigation is to shrink the adjacent attack surface: block untrusted hosts from the switch's Layer 2 segment by enforcing strict port-based VLAN separation, applying inbound ACLs on edge and guest ports, disabling unused physical ports, and enabling DHCP snooping/ARP and dynamic ARP inspection so a rogue device cannot position itself adjacent to the management plane. Restricting management access to a dedicated out-of-band or management VLAN with host allow-lists adds a second barrier, though attackers on the same L2 segment as the vulnerable service can still reach it, so this is partial only. The trade-off of aggressive port isolation and ACLs is operational friction - legitimate endpoints, VoIP handsets, and wireless AP uplinks may need explicit exceptions that must be maintained as the environment changes. Because the flaw is unauthenticated and triggerable with a single crafted packet, avoid treating segmentation as equivalent to patching; prioritize the firmware upgrade as soon as HPE publishes it, and monitor switches for unexpected reloads or crash dumps as an indicator of attempted exploitation. No public exploit code or CISA KEV listing exists at time of analysis, which lowers - but does not eliminate - the near-term likelihood of opportunistic scanning.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AOS-S is the operating system family used on Aruba/HPE wired switching hardware, and the reported defect is a memory-safety error (buffer overflow), the classic consequence of insufficient bounds checking when parsing or copying attacker-influenced data into fixed-size buffers. The CVSS vector is instructive: AV:A confirms the trigger comes from an adjacent network hop, AC:L indicates the attack is repeatable and low-complexity once that position is reached, and PR:N/UI:N confirm it is unauthenticated and requires no victim interaction. The high confidentiality impact (C:H) matches the advisory's 'expose sensitive memory contents' language, i.e. an out-of-bounds read that can leak device memory, while the high availability impact (A:H) reflects a crash or restart of the switch. Integrity is unaffected (I:N) and scope is changed (S:C), indicating the consequences can propagate beyond the vulnerable component itself - consistent with a core network device whose failure or leakage affects the surrounding network rather than just an isolated process. No CWE identifier was supplied with the source data, so the root cause is characterized here only by class (bounds-checking failure leading to out-of-bounds memory access) rather than a specific mapped weakness. No CPE entries were provided, so the exact model and firmware matrix must be taken from the HPE advisory rather than inferred.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.
Executive ViewAI
HPE Aruba AOS-S switch software is affected by a critical unauthenticated buffer overflow (CVE-2026-76746) that allows an attacker on an adjacent Layer 2 network segment to crash switches and read sensitive memory, threatening network availability and data confidentiality. Although no public exploit identified at time of analysis, the absence of a vendor-released patch and the CVSS 9.3 severity mean organizations using these switches face elevated operational and security risk until mitigations are applied. Leadership should prioritize immediate network segmentation and monitoring, and plan for emergency firmware updates once available.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing network segmentation to restrict Layer 2 adjacency, implementing port security and DHCP snooping, applying private VLANs, disabling unused ports, and monitoring for anomalous traffic; refer to HPE advisory hpesbnw05156en_us for any vendor-provided workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB