Live › vulnerability › CVE-2026-79857
Go to dashboardA command injection flaw in the PAPI access point management protocol of ArubaOS AOS-8 lets an unauthenticated remote attacker send crafted UDP packets. Successful exploitation runs arbitrary code as a privileged user on the underlying operating system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ArubaOS AOS-8 | vendor | unknown (see HPESBNW05162) | 8.13.3.1, 8.10.0.24 |
show version on each AOS-8 Mobility Conductor, Controller or Gateway8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train) should be treated as exposed until the HPESBNW05162 table says otherwiseUpgrade AOS-8 to 8.13.3.1 or 8.10.0.24 or later, per HPESBNW05162; the sources do not list the affected version ranges.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79857")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.