{"id":"CVE-2026-79856","kind":"vulnerability","aliases":["CVE-2026-79856"],"related":[],"title":"HPE AOS-8 wireless controllers: PAPI buffer overflow grants unauthenticated admin access","description":"A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","summary":"A buffer overflow in the PAPI protocol of HPE Aruba AOS-8 lets a remote attacker without credentials bypass authentication. A successful attacker gains administrative control, can change configuration, and can read or alter sensitive data.","severity":"critical","cvss":9.8,"epss":0.00512,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-8 (ArubaOS)","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["alcatel-lucent","aos-8","aruba","hpe","infrastructure","network-appliance","papi","self-hosted","wireless-controller"],"not_affected_if":["version-outside-range"],"how_to_check":"Run 'show version' on each AOS-8 controller and compare against the fixed versions.","fix":"Upgrade AOS-8 to 8.13.3.1 or later for the 8.13 branch, or to 8.10.0.24 or later for the 8.10 branch.\nRestrict access to the PAPI port at the network edge until patched.","status":"open","published_at":"2026-10-22T19:17:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:59+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:59Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 to 8.13.3.1 or later for the 8.13 branch, or to 8.10.0.24 or later for the 8.10 branch.\nRestrict access to the PAPI port at the network edge until patched.","reach":"network","title":"HPE AOS-8 wireless controllers: PAPI buffer overflow grants unauthenticated admin access","impact":"high","summary":"A buffer overflow in the PAPI protocol of HPE Aruba AOS-8 lets a remote attacker without credentials bypass authentication. A successful attacker gains administrative control, can change configuration, and can read or alter sensitive data.","category":"infrastructure","who_cares":["aos-8","aruba","hpe","wireless-controller","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gets administrative control of the wireless controller remotely.","analyst_note":"Confirm the PAPI port exposure and the exact 'show version' output or check command at https://nvd.nist.gov/vuln/detail/CVE-2026-79856 and the HPE advisory.","how_to_check":"Run 'show version' on each AOS-8 controller and compare against the fixed versions.\nunknown","needs_analyst":true,"not_affected_if":["version-outside-range"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000551,"input_tokens":3053,"output_tokens":491,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory (Alcatel-Lucent Enterprise security bulletin) for affected AOS-8 versions, fixed releases, and whether PAPI can be disabled; the NVD entry alone gives no versions or fix.","search":"'-2026':14A,17A '-79856':15A,18A '-8':3A,22A,28B,53B,89C 'access':12A,111C,116C 'admin':11A 'administr':66B,110C 'alcatel':25B 'alcatel-luc':24B 'allow':92C,105C 'alter':75B 'ao':2A,27B,52B,88C 'aos':21A 'applianc':34B 'aruba':29B,51B 'arubaos':23A 'attack':57B,64B,96C,107C 'authent':61B,100C 'buffer':7A,43B,79C 'bypass':60B 'chang':69B 'circumv':98C 'configur':70B,114C 'control':5A,41B,67B,101C 'could':91C,104C 'credenti':59B 'cve':13A,16A 'data':77B,120C 'exist':82C,99C 'exploit':103C 'gain':65B,109C 'grant':9A 'host':38B 'hpe':1A,19A,30B,50B 'infrastructur':31B 'let':54B 'lucent':26B 'manipul':118C 'modifi':112C 'network':33B 'network-appli':32B 'networking':20A 'overflow':8A,44B,80C 'papi':6A,35B,47B,85C 'protocol':48B,86C 'read':73B 'remot':56B,95C 'self':37B 'self-host':36B 'sensit':76B,119C 'success':63B,102C 'system':113C 'unauthent':10A,94C 'vulner':81C 'wireless':4A,40B 'wireless-control':39B 'without':58B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79856","severity":null,"published_at":"2026-10-22T19:17:57+00:00","modified_at":"2026-10-23T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79856:205","url":null,"severity":null,"published_at":"2026-10-23T22:20:59+00:00","modified_at":"2026-10-23T22:20:59+00:00","first_seen_at":"2026-10-23T22:20:59+00:00","fetched_at":"2026-10-23T22:20:59+00:00","note":"Not Alcatel-Lucent Enterprise: this is HPE Networking (Aruba) AOS-8, fixed in HPE bulletin HPESBNW05162 (2026-10-22; 72 CVEs). The HPE page is JS-only, so versions come from the CVE record and securityonline's reading of the bulletin. The start of the 8.12/8.13 range is inconsistent: cve.org says 8.13.0.0, others say 8.12.0.0. Check the bulletin. HPE reports no known exploitation and no public PoC. No PAPI disable option found; the mitigation is to restrict access."},{"source":"epss","external_id":"CVE-2026-79856","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79856","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1398,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79856","title":"CVE Record: CVE-2026-79856","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1338,"url":"https://securityonline.info/hpe-networking-aos-vulnerabilities/","title":"HPE Networking AOS Vulnerabilities Hit PAPI Protocol","kind":"blog","source":"analyst","text":"CVE-2026-79861 brings the same command-injection bug type as CVE-2026-79857 to AOS-10. PAPI listens on UDP 8211. Affected: AOS-10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13. Upgrade to 10.8.1.2, 10.7.2.7 or 10.4.1.14. Limit UDP 8211 to trusted devices.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}