---
id: "CVE-2026-79856"
kind: "vulnerability"
aliases: ["CVE-2026-79856"]
title: "HPE AOS-8 wireless controllers: PAPI buffer overflow grants unauthenticated admin access"
severity: "critical"
cvss: 9.8
epss: 0.00512
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking AOS-8 (ArubaOS)", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["alcatel-lucent", "aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "papi", "self-hosted", "wireless-controller"]
not_affected_if: ["version-outside-range"]
published_at: "2026-10-22T19:17:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79856", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:20:59+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79856", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE AOS-8 wireless controllers: PAPI buffer overflow grants unauthenticated admin access

A buffer overflow in the PAPI protocol of HPE Aruba AOS-8 lets a remote attacker without credentials bypass authentication. A successful attacker gains administrative control, can change configuration, and can read or alter sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking AOS-8 (ArubaOS) affected >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

Run 'show version' on each AOS-8 controller and compare against the fixed versions.

## Fix

Upgrade AOS-8 to 8.13.3.1 or later for the 8.13 branch, or to 8.10.0.24 or later for the 8.10 branch.
Restrict access to the PAPI port at the network edge until patched.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79856
- 2026-10-23T22:20:59+00:00 analyst — Not Alcatel-Lucent Enterprise: this is HPE Networking (Aruba) AOS-8, fixed in HPE bulletin HPESBNW05162 (2026-10-22; 72 CVEs). The HPE page is JS-only, so versions come from the CVE record and securityonline's reading of the bulletin. The start of the 8.12/8.13 range is inconsistent: cve.org says 8.13.0.0, others say 8.12.0.0. Check the bulletin. HPE reports no known exploitation and no public PoC. No PAPI disable option found; the mitigation is to restrict access.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79856

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] CVE Record: CVE-2026-79856 https://www.cve.org/CVERecord?id=CVE-2026-79856
- [fix] HPE Networking AOS Vulnerabilities Hit PAPI Protocol https://securityonline.info/hpe-networking-aos-vulnerabilities/
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_