{"id":"CVE-2026-79861","kind":"vulnerability","aliases":["CVE-2026-79861"],"related":[],"title":"HPE Aruba AOS-10: crafted PAPI packets let anyone run code as root","description":"There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.","summary":"HPE Aruba AOS-10 controllers and gateways have a command injection flaw in the PAPI management protocol. An unauthenticated attacker who sends specially crafted PAPI packets can run arbitrary code as a privileged user on the underlying operating system.","severity":"critical","cvss":9.8,"epss":0.01384,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.4.1.14","10.7.2.7","10.8.1.2"],"affected":">= 10.3.0.0, <= 10.4.1.13; >= 10.6.0.0, <= 10.7.2.6; >= 10.8.0.0, <= 10.8.1.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aruba","command-injection","hpe","infrastructure","network-gear","papi","rce"],"not_affected_if":["unpatched-version-not-in-range"],"how_to_check":"Check the installed AOS-10 version on each controller or gateway (show version) and compare it with the affected ranges.","fix":"Upgrade to 10.4.1.14, 10.7.2.7, or 10.8.1.2 depending on your branch.\nRestrict access to PAPI traffic on the network until patched.","status":"open","published_at":"2026-10-22T19:17:58+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:56+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 10.4.1.14, 10.7.2.7, or 10.8.1.2 depending on your branch.\nRestrict access to PAPI traffic on the network until patched.","reach":"network","title":"HPE Aruba AOS-10: crafted PAPI packets let anyone run code as root","impact":"high","summary":"HPE Aruba AOS-10 controllers and gateways have a command injection flaw in the PAPI management protocol. An unauthenticated attacker who sends specially crafted PAPI packets can run arbitrary code as a privileged user on the underlying operating system.","category":"infrastructure","who_cares":["aos-10","aruba","hpe","network-gear","papi"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code as privileged OS user","analyst_note":"Confirm whether PAPI is reachable by default and whether a version check command is published in the HPE advisory; see https://nvd.nist.gov/vuln/detail/CVE-2026-79861.","how_to_check":"Check the installed AOS-10 version on each controller or gateway (show version) and compare it with the affected ranges.\nunknown","needs_analyst":true,"not_affected_if":["unpatched-version-not-in-range"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000547,"input_tokens":3044,"output_tokens":486,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected AOS-10 versions and vendor advisory (Aruba/HPE security bulletin) for the fixed release and whether PAPI is exposed by default; NVD page alone gives no version or fix.","search":"'-10':4A,21A,23B,38B,82C '-2026':15A,18A '-79861':16A,19A 'abil':105C 'anyon':9A 'ao':3A,22B,37B,81C 'aos':20A 'arbitrari':63B,108C 'aruba':2A,24B,36B 'attack':54B 'code':11A,64B,89C,109C 'command':26B,44B,77C 'command-inject':25B 'control':39B 'could':84C 'craft':5A,58B,94C 'cve':14A,17A 'execut':90C,107C 'exploit':98C 'flaw':46B 'gateway':41B 'gear':32B 'hpe':1A,28B,35B 'infrastructur':29B 'inject':27B,45B,78C 'lead':85C 'let':8A 'manag':50B 'network':31B 'network-gear':30B 'oper':72B,117C 'packet':7A,60B,96C 'papi':6A,33B,49B,59B,95C 'privileg':67B,112C 'protocol':51B 'rce':34B 'remot':88C 'result':102C 'root':13A 'run':10A,62B 'send':56B,92C 'special':57B,93C 'success':97C 'system':73B,118C 'unauthent':53B,87C 'under':71B,116C 'user':68B,113C 'vulner':79C,101C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79861","severity":null,"published_at":"2026-10-22T19:17:58+00:00","modified_at":"2026-10-23T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79861:200","url":null,"severity":null,"published_at":"2026-10-23T22:17:56+00:00","modified_at":"2026-10-23T22:17:56+00:00","first_seen_at":"2026-10-23T22:17:56+00:00","fetched_at":"2026-10-23T22:17:56+00:00","note":"HPE bulletin HPESBNW05162 (22 Oct 2026) covers this; HPE page text not loaded, versions from securityonline/dailysecurityreview, verify against bulletin. Per-CVE rating/attack vector not confirmed (OpenCVE shows 9.8). No exploitation or PoC reported, not in KEV. X/community not searched."},{"source":"epss","external_id":"CVE-2026-79861","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79861","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1338,"url":"https://securityonline.info/hpe-networking-aos-vulnerabilities/","title":"HPE Networking AOS Vulnerabilities Hit PAPI Protocol","kind":"blog","source":"analyst","text":"CVE-2026-79861 brings the same command-injection bug type as CVE-2026-79857 to AOS-10. PAPI listens on UDP 8211. Affected: AOS-10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13. Upgrade to 10.8.1.2, 10.7.2.7 or 10.4.1.14. Limit UDP 8211 to trusted devices.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1376,"url":"https://dailysecurityreview.com/resources/hpe-patches-72-aruba-aos-8-and-aos-10-flaws-eight-at-cvss-10-0/","title":"HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws","kind":"blog","source":"analyst","text":"HPE reported no exploitation and no public PoC; none in CISA KEV.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}