EOL AOS-8 Deployments and CVE-2026-79846

Supported release branches have fixed software for CVE-2026-79846. Older AOS-8 deployments need a separate decision path. HPE states that products which have reached End of Maintenance are presumed affected unless the advisory says otherwise, and versions past End of Support have not been assessed for exposure.

That language puts lifecycle management inside the vulnerability response.

Why the fixed releases may not cover every asset

The advisory identifies fixes in AOS-8.13.3.1 and later and AOS-8.10.0.24 and later. An organization still running an earlier branch, an unsupported build or a device with an unknown software baseline cannot be closed by applying a patch to a different platform.

Inventory should include support status, contract status and the business owner of each wireless device. A controller that is critical but out of support needs a migration or exception decision. An isolated access point with no path to an approved fix needs a compensating control and a retirement date.

Confirm the actual branch

Version data from an old spreadsheet is not enough. Collect the active release from the device or its current management system. Check clustered nodes separately and confirm whether a standby partition could become active after a failure.

Record the device role as well as the version. HPE includes controllers, conductors, gateways and AOS-8 Instant Access Points in the affected product scope. A hardware list without software and role context can miss the systems that matter.

Decide between migration and containment

A supported path to a fixed release is the preferred outcome. If no supported upgrade exists, evaluate replacement or migration. Where neither can happen within the risk window, remove the management path from untrusted networks and apply the vendor's segmentation and accounting guidance.

Containment should have an owner, an expiry date and a review trigger. A temporary firewall rule without an owner tends to become permanent. A device that remains on an unsupported image should not be treated as remediated merely because it is difficult to reach.

Treat the external view as a lead

A formal ZoomEye Search for app="ArubaOS" returned 213 product-fingerprint matches at 2026-11-09T16:25:11Z. The CVE Filter returned zero. The product count does not identify the software branch or prove that a system is vulnerable. It can still show that an ArubaOS-associated address may be visible outside the expected boundary.

Compare external addresses with the asset register, hosting provider, site network and certificate inventory. If an old device appears on a public address, ask why it is there and who owns it. If the address is unrelated, document the exclusion without using it to dismiss the internal lifecycle gap.

Plan the transition

A transition plan should list the last supported configuration export, data and credentials that must be preserved, dependent services, replacement hardware and validation steps. Schedule the work with the wireless operations team because a failed controller replacement can interrupt authentication and network access.

After migration, verify that the new platform is in a fixed release, that old management addresses no longer respond and that monitoring still sees the replacement. Remove stale DNS, firewall and inventory records so the retired system does not remain a phantom exposure.

Report the residual risk

An executive report should distinguish supported devices on a fixed release, supported devices pending patch, unsupported devices with containment and unsupported devices with no approved control. This format avoids a false statement that the entire estate is patched when part of it cannot receive a vendor fix.

CVE-2026-79846 has a CVSS 3.1 score of 10.0 and can allow arbitrary command execution when the external preconditions are met. The lack of a public exploit at release does not convert an unsupported device into a low-risk one. Lifecycle debt is part of the exposure until it is retired or controlled.

References

1. HPE Networking Security Advisory HPESBNW05162: https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
2. CERT-FR advisory CERTFR-2026-AVI-1369: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1369/
3. CVE record CVE-2026-79846: https://www.cve.org/CVERecord?id=CVE-2026-79846
4. OpenCVE record for CVE-2026-79846: https://app.opencve.io/cve/CVE-2026-79846