CVE-2026-79846 Response Checklist for Managed Service Providers

A managed service provider handling ArubaOS for several customers needs a response that keeps customer boundaries intact. CVE-2026-79846 is a critical AOS-8 command injection, and remediation evidence for one customer does not apply to another.

The work starts with a tenant-aware asset inventory and ends with a customer-specific completion record.

Establish tenant scope

Map every AOS-8 controller, conductor, gateway and access point to a customer, site and service contract. Include devices managed through HPE Networking Central and devices that the provider can see but does not administer. The latter are referral items, not silently excluded assets.

HPE lists AOS-8.13.0.0 through 8.13.3.0 and AOS-8.10.0.0 through 8.10.0.23 as affected. Collect the active version per device and per cluster node. Keep customer data separate in the ticket and reporting workflow while preserving enough evidence for an auditor to verify the claim.

Apply a common method with local decisions

The provider can use one investigation method across customers, but each customer needs a local patch window, service dependency and approval path. A shared management platform may reduce effort, yet a broad administrative identity can also turn one compromised workstation into a multi-customer problem.

Review provider access first. Limit administrative paths to approved jump hosts and automation identities. Use customer-specific groups where possible. Confirm that logging identifies the provider operator, customer, device and time. HPE's recommended management VLAN and firewall controls should be part of the service baseline.

Coordinate patches

HPE fixed the issue in AOS-8.13.3.1 and later and AOS-8.10.0.24 and later. Schedule upgrades by customer and service impact. Verify the active version after reboot, cluster health and management connectivity. Do not mark a customer complete because another customer at the same site was patched.

For devices that cannot be upgraded in the first window, remove untrusted management paths and document the expiry of the exception. Keep the customer informed about what remains exposed and what compensating control is active.

Investigate suspicious management activity

Collect firewall, authentication, management-interface, configuration and availability records for each tenant. Look for new sources reaching a management address, unexplained configuration changes, repeated failures followed by success and logging changes outside a maintenance window.

The public advisory does not identify the exact interface or provide exploit code. An investigation should therefore preserve broad management evidence without claiming a specific payload match. If a device ran an affected release and an unapproved source reached it, escalate for the customer and preserve evidence before a reboot where operationally possible.

Report exposure without overstating it

ZoomEye can add an outside-in view. A formal Search for app="ArubaOS" returned 213 product-fingerprint matches at 2026-11-09T16:25:11Z. The CVE Filter returned zero. The product count is not a confirmed vulnerable inventory, and the zero filter is not proof that a customer has no affected asset.

Provide the customer with the query and timestamp if external context is included. Separate product matches from verified software findings. Avoid presenting a global search result as a tenant incident.

Close with customer evidence

Each customer record should show affected devices, fixed devices, unresolved versions, management-boundary status, patch window and validation time. Include the fixed target for the deployed branch and the person who confirmed it.

Review exceptions at a defined interval. A provider that cannot show which customer still has an affected release cannot defend a broad statement that the estate has been remediated. The completion standard is a tenant-specific evidence trail that connects asset, software, network path and action.

References

1. HPE Networking Security Advisory HPESBNW05162: https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
2. CERT-FR advisory CERTFR-2026-AVI-1369: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1369/
3. CVE record CVE-2026-79846: https://www.cve.org/CVERecord?id=CVE-2026-79846
4. OpenCVE record for CVE-2026-79846: https://app.opencve.io/cve/CVE-2026-79846