Live › vulnerability › CVE-2026-79856
Go to dashboardA buffer overflow in the PAPI protocol of HPE Aruba AOS-8 lets a remote attacker without credentials bypass authentication. A successful attacker gains administrative control, can change configuration, and can read or alter sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HPE Networking AOS-8 (ArubaOS) | vendor | >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
Run show version on each AOS-8 controller and compare against the fixed versions.
8.13.3.1 or later for the 8.13 branch, or to 8.10.0.24 or later for the 8.10 branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
This page as .md · .json · in your agent: get_signal("CVE-2026-79856")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.