Live › vulnerability › CVE-2026-79861
Go to dashboardHPE Aruba AOS-10 controllers and gateways have a command injection flaw in the PAPI management protocol. An unauthenticated attacker who sends specially crafted PAPI packets can run arbitrary code as a privileged user on the underlying operating system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-10 | vendor | >= 10.3.0.0, <= 10.4.1.13; >= 10.6.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1 | 10.4.1.14, 10.7.2.7, 10.8.1.2 |
Check the installed AOS-10 version on each controller or gateway (show version) and compare it with the affected ranges.
10.4.1.14, 10.7.2.7, or 10.8.1.2 depending on your branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79861")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.