---
id: CVE-2026-95720
title: >-
  Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service
  in AOS-8
summary: >-
  A buffer overflow vulnerability exists in AOS-8 that could allow an
  authenticated attacker with administrative access to cause denial of service.
  Successful exploitation could allow an attacker to crash the system,
  preventing it from reb…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T15:18:14.898524Z'
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T19:14:23.808Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95720'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.04149
ingestedAt: '2026-10-22T22:00:50.392Z'
---

## Overview

A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service. Successful exploitation could allow an attacker to crash the system, preventing it from rebooting without manual intervention and disrupting network operations.

## Affected

- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.