--- id: "CVE-2026-79860" kind: "vulnerability" aliases: ["CVE-2026-79860"] title: "Aruba AOS-8 controllers: unauthenticated remote code execution over PAPI port 8211" severity: "critical" cvss: 9.8 epss: 0.00603 exploited: false status: "open" category: "infrastructure" products: [{"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}, {"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": "8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23; EoM releases (e.g. 8.12.x) presumed affected", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["aos-8", "aruba", "infrastructure", "network-appliance", "papi"] not_affected_if: ["no-aos-8-devices", "version-outside-affected-range"] published_at: "2026-10-22T19:17:58+00:00" first_seen_at: "2026-10-23T21:57:32+00:00" updated_at: "2026-10-25T12:38:51+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79860", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:19:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:46:19+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79860", "first_seen_at": "2026-10-24T07:15:51+00:00"}] --- # Aruba AOS-8 controllers: unauthenticated remote code execution over PAPI port 8211 A buffer overflow in an AOS-8 network service lets an attacker send crafted UDP packets to port 8211 and run code as a privileged user on the controller's operating system, with no login needed. The sources rate it critical (CVSS 9.8) and say it is not known to be exploited in the wild. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:AOS-8 affected >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24 - vendor:AOS-8 affected 8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23; EoM releases (e.g. 8.12.x) presumed affected fixed 8.13.3.1, 8.10.0.24 ## How to check On each Mobility Conductor, Mobility Controller, Mobility Gateway or Instant AP, run 'show version'. Affected if AOS-8 is 8.13.3.0 or older in the 8.13 line, or 8.10.0.23 or older in the 8.10 line. EoM releases such as 8.12 are presumed affected by HPE. To see exposure, check from a non-management network whether UDP 8211 (PAPI) answers, for example 'nmap -sU -p 8211 ', and review firewall rules in front of the devices. The HPE bulletin gives no 8211-specific check or default-exposure statement. ## Fix Upgrade AOS-8 to 8.13.3.1 or later (8.13 line) or 8.10.0.24 or later (8.10 line); downloads at networkingsupport.hpe.com. If you cannot patch yet, HPE's workaround is to restrict CLI and web management interfaces to a dedicated L2 segment/VLAN and/or firewall them at L3 and above, with accounting controls. HPE does not say this specifically covers PAPI UDP 8211, so also block UDP 8211 from untrusted networks. HPE found no public PoC or exploitation as of release. ## Timeline - 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79860 - 2026-10-23T22:19:05+00:00 analyst — Vendor bulletin HPESBNW05162 (Oct 22 2026) is JS-only, text not readable by web-cli. Affected ranges are from the CVE record (search snippet). Fixed versions are from Mallory, a secondary source, so check them against the HPE bulletin. BleepingComputer quotes HPE saying no public PoC or exploitation known at release. Whether UDP 8211 is exposed beyond management networks is not confirmed. - 2026-10-23T22:46:19+00:00 analyst — Read the vendor's own text of HPESBNW05162 (CSAF .txt). It confirms fixed versions and the workaround. It lists affected AOS-8 as 8.13.x <= 8.13.3.0 and 8.10.x <= 8.10.0.23. 8.12 is not listed, so I corrected the earlier range, which came from the CVE record snippet. The bulletin gives no 8211-specific check and no statement on default exposure. The CVE-2026-79860 detail entry was cut off in the page text I got. HPE's article on UDP 8900/8211 being open was not readable (JS-only). - 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79860 ## Documents - [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US - [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt - [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/ - [fix] Mallory: CVE-2026-79860 https://mallory.ai/vulnerabilities/CVE-2026-79860 ## From the sources Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_