HPE Aruba AOS-8: unauthenticated PAPI path traversal reads, edits, deletes OS files

1. NVD2026-10-23 21:57 UTC · published 2026-10-22 19:17 UTC · CVE-2026-79866
2. InfraStack analyst2026-10-23 22:16 UTC · published 2026-10-23 22:16 UTC
   “Vendor advisory HPESBNW05162 (2026-10-22) read: AOS-8 <=8.13.3.0 and <=8.10.0.23 affected, fixed 8.13.3.1 / 8.10.0.24. The advisory body I got was truncated before the per-CVE section for 79866, so the PAPI path traversal wording comes from the NVD description. HPE says no known public exploit or discussion. No social posts searched.”
3. InfraStack analyst2026-10-23 22:45 UTC · published 2026-10-23 22:45 UTC
   “Read the CVE-2026-79866 section of HPESBNW05162 (title: Unauthenticated Adjacent Path Traversal leads to Filesystem Compromise in AOS-8; VULN-1123; CVSS 9.6, AV:A). The advisory does not say whether PAPI is on by default and names no port in this CVE's section. UDP 8211 is from sibling CVEs in the same bulletin (79860, 79878) and the AOS 8.10 docs (svc-papi udp 8211). The 2024 advisory's cluster-security / block-8211 workaround is for older CVEs; it is not confirmed for this one.”
4. EPSS2026-10-24 07:15 UTC · CVE-2026-79866

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-79866 · 10-23 21:57
• EPSS: CVE-2026-79866 · 10-24 07:15
• HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisoryAdvisory · InfraStack analyst
• HPE patches eight max severity RCE and auth bypass AOS flawsMentions it · InfraStack analyst
• ArubaOS 8.10 Web Help: Understanding Basic System Defaults (svc-papi udp 8211)Describes it · InfraStack analyst
• HPESBNW04722 (2024): earlier PAPI UDP 8211 advisory with cluster-security / block-8211 workaroundMitigation · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-79866")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.