CVE-2026-79871 affects AOS-10 software across several wireless product roles. A fleet-wide version report is necessary, but it does not decide the order of work on its own. Management reachability, device trust and the information a device can reveal should shape the first wave.
The product scope is broad
HPE lists Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central and AOS-10 access points in the advisory's product scope. The selected CVE has no specific exclusion in the detail section. Affected branches are 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6 and 10.4.0.0 through 10.4.1.13. Fixed releases are 10.8.1.2, 10.7.2.7 and 10.4.1.14.
The role does not change the need for a fixed build. It changes the questions asked before and after the upgrade.
Conductors and controllers
A conductor or controller can hold configuration, service relationships and administrative context for many connected devices. HPE says the CLI flaw can expose sensitive information and that the retrieved information could potentially help an attacker gain further access to network services supported by AOS-10.
For triage, ask who can reach the management address, whether the CLI is reachable outside an approved management segment, and which integrations trust the device. Preserve administrative logs and configuration history before maintenance. Confirm that the model supports the intended fixed release and that console access remains available for recovery.
Gateways and access points
Gateways managed by HPE Networking Central may sit at a boundary between management and operational networks. Access points are often numerous and may be less tightly governed, but they can still be reached from a shared management VLAN or an automation network. Do not remove them from scope because they appear less privileged.
Use the same evidence for each device: running image, management interface, network path, owner and support status. For high-volume access-point fleets, group by branch and management zone, then verify a representative sample? No, every device still needs an image check, while the same path review can be reused for a documented zone design.
What the CVE does not establish
The advisory does not identify the exact CLI command, response fields or data classes exposed. It does not state that all affected devices are compromised or that every product role offers the same downstream value. The CVSS vector is adjacent network with no privileges or user interaction, but exploitation still requires a reachable attack position.
This is why a scanner match or a public product fingerprint is not enough to rank a device as exploited. Triage should record uncertainty as a field, not bury it in an assumption.
A working priority model
Start with devices in an affected branch. Within that set, put unauthenticated adjacent reachability first, especially from shared administrative, remote-support or guest networks. Next consider the value of information a role may expose and the strength of trust relationships around it.
A controller with a narrow management path may still outrank a broadly reachable access point because of its role, or the reverse may be true in a large distributed environment. The important part is to state the reason and let the patch schedule reflect it.
Exposure evidence
ZoomEye Search app="ArubaOS" returned 212 matches. The CVE Filter returned 0. Exposure is 212 for the selected successful product query, but this is not a count of confirmed vulnerable devices. It can help identify ArubaOS assets that need authorized ownership and version checks.
Search: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcnViYU9TIg%3D%3D
Interim and final controls
HPE recommends a dedicated layer 2 segment or VLAN for CLI and web management interfaces, layer 3 firewall policy and accounting controls. Apply those controls where a role cannot be patched within the planned window. Then upgrade every affected device to the fixed branch release.
Complete the record with the running image, the approved management path and the status of logging. CVE-2026-79871 is one vulnerability across a varied product family; the response should be consistent in scope and explicit about why individual devices were prioritized.