{"id":"CVE-2026-79860","kind":"vulnerability","aliases":["CVE-2026-79860"],"related":[],"title":"Aruba AOS-8 controllers: unauthenticated remote code execution over PAPI port 8211","description":"Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","summary":"A buffer overflow in an AOS-8 network service lets an attacker send crafted UDP packets to port 8211 and run code as a privileged user on the controller's operating system, with no login needed. The sources rate it critical (CVSS 9.8) and say it is not known to be exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.00603,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"},{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23; EoM releases (e.g. 8.12.x) presumed affected","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","infrastructure","network-appliance","papi"],"not_affected_if":["no-aos-8-devices","version-outside-affected-range"],"how_to_check":"On each Mobility Conductor, Mobility Controller, Mobility Gateway or Instant AP, run 'show version'. Affected if AOS-8 is 8.13.3.0 or older in the 8.13 line, or 8.10.0.23 or older in the 8.10 line. EoM releases such as 8.12 are presumed affected by HPE. To see exposure, check from a non-management network whether UDP 8211 (PAPI) answers, for example 'nmap -sU -p 8211 <device>', and review firewall rules in front of the devices. The HPE bulletin gives no 8211-specific check or default-exposure statement.","fix":"Upgrade AOS-8 to 8.13.3.1 or later (8.13 line) or 8.10.0.24 or later (8.10 line); downloads at networkingsupport.hpe.com. If you cannot patch yet, HPE's workaround is to restrict CLI and web management interfaces to a dedicated L2 segment/VLAN and/or firewall them at L3 and above, with accounting controls. HPE does not say this specifically covers PAPI UDP 8211, so also block UDP 8211 from untrusted networks. HPE found no public PoC or exploitation as of release.","status":"open","published_at":"2026-10-22T19:17:58+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:56+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:31:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 to 8.13.3.1 or later in the 8.13 line, or to 8.10.0.24 or later in the 8.10 line.\nunknown","reach":"network","title":"Aruba AOS-8 controllers: unauthenticated remote code execution over PAPI port 8211","impact":"high","summary":"A buffer overflow in an AOS-8 network service lets an attacker send crafted UDP packets to port 8211 and run code as a privileged user on the controller's operating system, with no login needed. The sources rate it critical (CVSS 9.8) and say it is not known to be exploited in the wild.","category":"infrastructure","who_cares":["aos-8","aruba","network-appliance","papi"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as root on the controller without credentials.","analyst_note":"Confirm whether PAPI UDP 8211 is reachable from untrusted networks by default and get a command or config check for exposure from the Aruba advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-79860 links the vendor bulletin).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-outside-affected-range"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000542,"input_tokens":3039,"output_tokens":477,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether PAPI UDP 8211 is reachable from untrusted networks by default and get a command or config check for exposure from the Aruba advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-79860 links the vendor bulletin).","search":"'-2026':14A,17A '-79860':15A,18A '-8':3A,20A,22A,24B,37B,96C '8211':12A,49B,122C '9.8':73B 'access':116C 'allow':126C 'ao':2A,23B,36B,95C 'aos':19A,21A 'applianc':29B 'arbitrari':131C 'aruba':1A,25B,114C 'attack':42B,128C 'buffer':32B,86C 'code':7A,52B,103C,132C 'control':4A,59B 'could':98C,125C 'craft':44B,108C 'critic':71B 'cve':13A,16A 'cvss':72B 'destin':110C 'execut':8A,104C,130C 'exist':89C 'exploit':82B,124C 'infrastructur':26B 'known':79B 'lead':99C 'let':40B 'login':65B 'manag':118C 'need':66B 'network':28B,38B 'network-appli':27B 'oper':61B,140C 'overflow':33B,87C 'packet':46B,109C 'papi':10A,30B,113C 'point':117C 'port':11A,48B,121C 'privileg':55B,135C 'protocol':119C 'rate':69B 'remot':6A,102C 'run':51B 'say':75B 'send':43B,106C 'servic':39B,93C 'sourc':68B 'special':107C 'success':123C 'system':62B,141C 'udp':45B,120C 'unauthent':5A,101C 'under':92C,139C 'user':56B,136C 'vulner':88C 'wild':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79860","severity":null,"published_at":"2026-10-22T19:17:58+00:00","modified_at":"2026-10-23T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79860:201","url":null,"severity":null,"published_at":"2026-10-23T22:19:05+00:00","modified_at":"2026-10-23T22:19:05+00:00","first_seen_at":"2026-10-23T22:19:05+00:00","fetched_at":"2026-10-23T22:19:05+00:00","note":"Vendor bulletin HPESBNW05162 (Oct 22 2026) is JS-only, text not readable by web-cli. Affected ranges are from the CVE record (search snippet). Fixed versions are from Mallory, a secondary source, so check them against the HPE bulletin. BleepingComputer quotes HPE saying no public PoC or exploitation known at release. Whether UDP 8211 is exposed beyond management networks is not confirmed."},{"source":"analyst","external_id":"CVE-2026-79860:293","url":null,"severity":null,"published_at":"2026-10-23T22:46:19+00:00","modified_at":"2026-10-23T22:46:19+00:00","first_seen_at":"2026-10-23T22:46:19+00:00","fetched_at":"2026-10-23T22:46:19+00:00","note":"Read the vendor's own text of HPESBNW05162 (CSAF .txt). It confirms fixed versions and the workaround. It lists affected AOS-8 as 8.13.x <= 8.13.3.0 and 8.10.x <= 8.10.0.23. 8.12 is not listed, so I corrected the earlier range, which came from the CVE record snippet. The bulletin gives no 8211-specific check and no statement on default exposure. The CVE-2026-79860 detail entry was cut off in the page text I got. HPE's article on UDP 8900/8211 being open was not readable (JS-only)."},{"source":"epss","external_id":"CVE-2026-79860","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79860","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1390,"url":"https://mallory.ai/vulnerabilities/CVE-2026-79860","title":"Mallory: CVE-2026-79860","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}