{"id":"CVE-2026-79857","kind":"vulnerability","aliases":["CVE-2026-79857"],"related":[],"title":"ArubaOS AOS-8: unauthenticated crafted UDP packets run commands as root","description":"There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","summary":"A command injection flaw in the PAPI access point management protocol of ArubaOS AOS-8 lets an unauthenticated remote attacker send crafted UDP packets. Successful exploitation runs arbitrary code as a privileged user on the underlying operating system.","severity":"critical","cvss":9.8,"epss":0.01259,"exploited":false,"exploited_at":null,"products":[{"name":"ArubaOS AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"unknown (see HPESBNW05162)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","arubaos","infrastructure","network-appliance","papi","rce","wireless-controller"],"not_affected_if":["unknown"],"how_to_check":"Run 'show version' on each AOS-8 Mobility Conductor, Controller or Gateway. Anything older than 8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train) should be treated as exposed until the HPESBNW05162 table says otherwise. Check whether UDP 8211 (PAPI) is reachable from untrusted networks.","fix":"Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24 or later, per HPESBNW05162; the sources do not list the affected version ranges.","status":"open","published_at":"2026-10-22T19:17:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:59+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T22:31:59Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24 or later, per HPESBNW05162; the sources do not list the affected version ranges.","reach":"network","title":"ArubaOS AOS-8: unauthenticated crafted UDP packets run commands as root","impact":"high","summary":"A command injection flaw in the PAPI access point management protocol of ArubaOS AOS-8 lets an unauthenticated remote attacker send crafted UDP packets. Successful exploitation runs arbitrary code as a privileged user on the underlying operating system.","category":"infrastructure","who_cares":["arubaos","aos-8","wireless-controller","papi"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code as a privileged OS user on the controller.","analyst_note":"Confirm affected version ranges and the UDP port, and any PAPI mitigation, in HPESBNW05162 (HPE advisory); the sources leave how_to_check and affected versions unknown.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000522,"input_tokens":3018,"output_tokens":441,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected version ranges and the UDP port, and any PAPI mitigation, in HPESBNW05162 (HPE advisory); the sources leave how_to_check and affected versions unknown.","search":"'-2026':13A,16A '-79857':14A,17A '-8':3A,20A,22B,48B,90C 'abil':117C 'access':41B,84C 'affect':106C 'ao':2A,21B,47B,89C 'aos':19A 'applianc':28B 'arbitrari':61B,120C 'aruba':23B,82C 'arubao':1A,24B,46B 'arubaos':18A 'attack':53B 'code':62B,97C,121C 'command':9A,35B,75C 'control':33B 'could':92C 'craft':5A,55B,102C 'cve':12A,15A 'execut':98C,119C 'exploit':59B,110C 'flaw':37B 'infrastructur':25B 'inject':36B,76C 'lead':93C 'let':49B 'manag':43B,86C 'network':27B 'network-appli':26B 'oper':70B,129C 'packet':7A,57B,103C 'papi':29B,40B,80C 'point':42B,85C 'port':108C 'privileg':65B,124C 'protocol':44B,81C,87C 'rce':30B 'remot':52B,96C 'result':114C 'root':11A 'run':8A,60B 'send':54B,100C 'special':101C 'success':58B,109C 'system':71B,130C 'udp':6A,56B,107C 'unauthent':4A,51B,95C 'under':69B,128C 'user':66B,125C 'vulner':77C,113C 'wireless':32B 'wireless-control':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79857","severity":null,"published_at":"2026-10-22T19:17:57+00:00","modified_at":"2026-10-23T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79857:204","url":null,"severity":null,"published_at":"2026-10-23T22:18:57+00:00","modified_at":"2026-10-23T22:18:57+00:00","first_seen_at":"2026-10-23T22:18:57+00:00","fetched_at":"2026-10-23T22:18:57+00:00","note":"Part of HPE advisory HPESBNW05162 (2026-10-22, 72 CVEs). The HPE page was JS-only and returned no body, so fixed releases come from secondary coverage. The per-CVE AOS-8 affected range is unknown; the advisory table would settle it. HPE reports no exploitation and no public PoC. CVSS 9.8."},{"source":"analyst","external_id":"CVE-2026-79857:294","url":null,"severity":null,"published_at":"2026-10-23T22:46:05+00:00","modified_at":"2026-10-23T22:46:05+00:00","first_seen_at":"2026-10-23T22:46:05+00:00","fetched_at":"2026-10-23T22:46:05+00:00","note":"Revisit: no new sources or documents since run 204. The CSAF text for HPESBNW05162 is not at the guessed URL and the HPE page is JS-only, so the affected range is still unknown. Re-stated how-to-check, which showed as unknown."},{"source":"epss","external_id":"CVE-2026-79857","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79857","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1376,"url":"https://dailysecurityreview.com/resources/hpe-patches-72-aruba-aos-8-and-aos-10-flaws-eight-at-cvss-10-0/","title":"HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws","kind":"blog","source":"analyst","text":"HPE reported no exploitation and no public PoC; none in CISA KEV.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1338,"url":"https://securityonline.info/hpe-networking-aos-vulnerabilities/","title":"HPE Networking AOS Vulnerabilities Hit PAPI Protocol","kind":"blog","source":"analyst","text":"CVE-2026-79861 brings the same command-injection bug type as CVE-2026-79857 to AOS-10. PAPI listens on UDP 8211. Affected: AOS-10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13. Upgrade to 10.8.1.2, 10.7.2.7 or 10.4.1.14. Limit UDP 8211 to trusted devices.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}