CVE-2026-79872
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Risk Assessment
An attacker can remotely execute arbitrary code with high privileges without authentication, risking full device takeover and infrastructure compromise.
Recommendation
Install the AOS updates that fix the vulnerability immediately and limit device exposure to untrusted networks.
Other vulnerabilities in AOS
See all- CVE-2026-79852Critical
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- CVE-2026-95717Medium
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS. An authenticated remote attacker with high privileges could inject malicious scripts. Successful exploitation could execute arbitrary script code in the context of another authenticated user's browser session.
Original NVD description (English source)
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS