A CVSS score of 10.0 tells a team that CVE-2026-79851 has severe potential. It does not tell the team which device to patch first when maintenance windows are limited.
HPE describes an unauthenticated buffer overflow in an affected AOS-10 interface that can execute code as a privileged user. The CVE record gives the issue a network vector, low complexity, no privileges and changed scope. The public advisory does not identify the exact interface. A useful priority queue must therefore combine the confirmed software range with internal reachability and device importance.
Use hard gates first
Start with the live AOS-10 version. The affected ranges are 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6 and 10.4.0.0 through 10.4.1.13.
A device outside those branches does not enter this particular queue, but it may still be affected by another CVE in HPESBNW05162. A device with an unknown version stays in the queue until the owner produces evidence.
The fixed release is branch-specific: 10.8.1.2, 10.7.2.7 or 10.4.1.14. Record the target before ranking the work.
Score the reachable path
The vulnerability is unauthenticated and network reachable. Identify whether the management interface can be reached from the public Internet, a partner network, a user VLAN, a remote-access pool or only a dedicated administrative segment.
A confirmed Internet path can justify expedited isolation even when the exact vulnerable interface is unknown. So can a path from a low-trust internal network to a high-value controller. A device on an affected version remains vulnerable regardless of the score, but the reachability evidence helps decide the immediate response.
Check firewall and routing for IPv4 and IPv6. Confirm temporary support and automation paths. A broad route through a monitoring subnet can erase the benefit of a dedicated management VLAN.
Consider blast radius
A Mobility Conductor may influence multiple controllers. A controller may support many sites and access points. A gateway may connect wireless policy to wider network or cloud services. An access point may expose a branch segment.
Capture the number of dependent devices, business services, trust relationships and administrators. Then ask what an attacker could change or observe from the compromised role. This is the operational consequence that a severity score cannot answer.
Avoid using product model alone as a proxy for importance. A small site gateway can carry a critical service. A large controller may be tightly isolated and thoroughly monitored.
Build four action tiers
Tier one can include affected devices reachable from an untrusted network with high operational consequence. Isolate the management plane immediately and schedule the earliest feasible fix.
Tier two can include affected devices with limited reachability but substantial trust relationships. Patch within the planned emergency cycle and verify compensating controls.
Tier three can include affected devices on a narrow management path. They still need a dated patch plan. Recheck that the path remains narrow after every change.
Tier four includes confirmed fixed devices. Keep the evidence and review date. A later rollback or configuration change can return a device to an unsafe state.
Apply the interim control
HPE recommends restricting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN and controlling access with Layer 3 firewall policy. Add accounting for administrative activity.
The control is especially useful for tier one and tier two devices while upgrades are arranged. Test it from an unapproved source and preserve its logs. Do not count a planned firewall rule as an implemented control.
Update the queue with evidence
The ranking should change when evidence changes. A new public exposure raises reachability. A completed upgrade closes the CVE-specific risk after live verification. An unknown version opens a gap that no prior scan closes.
Record who owns each decision and the date of the next review. This keeps the queue from becoming a static spreadsheet after the initial emergency.
Exposure context
A ZoomEye Search for app="ArubaOS" returned 212 product-fingerprint matches. The CVE Filter returned 0. The count is a discovery signal for a product class. It is not a list of vulnerable devices and cannot determine which management paths are reachable.
A defensible priority
The strongest priority combines four facts: the device is on an affected release, its management plane is reachable, its role has meaningful blast radius and the fix is not yet installed. CVE-2026-79851 supplies the severity and the software range. The organization must supply the remaining evidence.