---
id: "CVE-2026-79857"
kind: "vulnerability"
aliases: ["CVE-2026-79857"]
title: "ArubaOS AOS-8: unauthenticated crafted UDP packets run commands as root"
severity: "critical"
cvss: 9.8
epss: 0.01259
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ArubaOS AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": "unknown (see HPESBNW05162)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "arubaos", "infrastructure", "network-appliance", "papi", "rce", "wireless-controller"]
not_affected_if: ["unknown"]
published_at: "2026-10-22T19:17:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79857", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:18:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:46:05+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79857", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# ArubaOS AOS-8: unauthenticated crafted UDP packets run commands as root

A command injection flaw in the PAPI access point management protocol of ArubaOS AOS-8 lets an unauthenticated remote attacker send crafted UDP packets. Successful exploitation runs arbitrary code as a privileged user on the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ArubaOS AOS-8 affected unknown (see HPESBNW05162) fixed 8.13.3.1, 8.10.0.24

## How to check

Run 'show version' on each AOS-8 Mobility Conductor, Controller or Gateway. Anything older than 8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train) should be treated as exposed until the HPESBNW05162 table says otherwise. Check whether UDP 8211 (PAPI) is reachable from untrusted networks.

## Fix

Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24 or later, per HPESBNW05162; the sources do not list the affected version ranges.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79857
- 2026-10-23T22:18:57+00:00 analyst — Part of HPE advisory HPESBNW05162 (2026-10-22, 72 CVEs). The HPE page was JS-only and returned no body, so fixed releases come from secondary coverage. The per-CVE AOS-8 affected range is unknown; the advisory table would settle it. HPE reports no exploitation and no public PoC. CVSS 9.8.
- 2026-10-23T22:46:05+00:00 analyst — Revisit: no new sources or documents since run 204. The CSAF text for HPESBNW05162 is not at the guessed URL and the HPE page is JS-only, so the affected range is still unknown. Re-stated how-to-check, which showed as unknown.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79857

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws https://dailysecurityreview.com/resources/hpe-patches-72-aruba-aos-8-and-aos-10-flaws-eight-at-cvss-10-0/
- [mentions] HPE Networking AOS Vulnerabilities Hit PAPI Protocol https://securityonline.info/hpe-networking-aos-vulnerabilities/
- [mitigation] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_