{"id":"CVE-2026-79866","kind":"vulnerability","aliases":["CVE-2026-79866"],"related":[],"title":"HPE Aruba AOS-8: unauthenticated PAPI path traversal reads, edits, deletes OS files","description":"An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.","summary":"HPE Aruba AOS-8 controllers have a path traversal flaw in the PAPI protocol that needs no login. An attacker on an adjacent network can read, modify and delete files on the underlying operating system.","severity":"critical","cvss":9.6,"epss":0.00195,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","network-controller","papi"],"not_affected_if":["aos-10-only","fixed-version","management-plane-isolated","no-aos-8-deployment"],"how_to_check":"Run 'show version' on the Mobility Conductor/Controller: affected if 8.13.x <= 8.13.3.0 or 8.10.x <= 8.10.0.23. PAPI is Aruba's AP-to-controller management protocol on UDP 8211 (predefined service svc-papi). HPE does not say whether it is enabled by default; assume it is reachable on controllers and check whether UDP 8211 is reachable from non-AP hosts on the same L2 segment/VLAN, since the attacker must be adjacent.","fix":"Upgrade AOS-8 8.13.x to 8.13.3.1 or 8.10.x to 8.10.0.24 or later. Only workaround in this bulletin: restrict CLI and web management interfaces to a dedicated L2 VLAN and/or firewall them at L3+. For earlier PAPI CVEs HPE also advised blocking UDP/8211 from untrusted networks and enabling cluster-security on Instant APs; HPE has not stated that applies here, so treat it as hardening only.","status":"open","published_at":"2026-10-22T19:17:58+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:52+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:52Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 8.13.x to 8.13.3.1 or AOS-8 8.10.x to 8.10.0.24, per the affected ranges listed.","reach":"network","title":"HPE Aruba AOS-8: unauthenticated PAPI path traversal reads, edits, deletes OS files","impact":"high","summary":"HPE Aruba AOS-8 controllers have a path traversal flaw in the PAPI protocol that needs no login. An attacker on an adjacent network can read, modify and delete files on the underlying operating system.","category":"infrastructure","who_cares":["aos-8","aruba","hpe","network-controller"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker reads, modifies and deletes OS files on the controller.","analyst_note":"Find out whether PAPI is enabled by default and which ports it listens on, using the HPE advisory for CVE-2026-79866 (not in the sources).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fixed-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000507,"input_tokens":2990,"output_tokens":415,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find out whether PAPI is enabled by default and which ports it listens on, using the HPE advisory for CVE-2026-79866 (not in the sources).","search":"'-2026':15A,18A '-79866':16A,19A '-8':4A,23A,25B,36B,80C 'adjac':55B,90C 'allow':87C 'ao':3A,24B,35B,79C 'aos':22A 'aruba':2A,26B,34B 'attack':52B,91C 'control':31B,37B 'could':86C 'cve':14A,17A 'delet':11A,61B,96C 'edit':10A 'exist':73C 'exploit':82C 'file':13A,62B,97C 'flaw':42B 'hpe':1A,20A,27B,33B 'infrastructur':28B 'login':50B 'modifi':59B,94C 'need':48B 'network':30B,56B 'network-control':29B 'networking':21A 'oper':66B,101C 'os':12A 'papi':6A,32B,45B,76C 'path':7A,40B,70C 'protocol':46B,77C 'read':9A,58B,93C 'success':81C 'system':67B,102C 'travers':8A,41B,71C 'unauthent':5A,69C,89C 'under':65B,100C 'vulner':72C,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79866","severity":null,"published_at":"2026-10-22T19:17:58+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79866:195","url":null,"severity":null,"published_at":"2026-10-23T22:16:47+00:00","modified_at":"2026-10-23T22:16:47+00:00","first_seen_at":"2026-10-23T22:16:47+00:00","fetched_at":"2026-10-23T22:16:47+00:00","note":"Vendor advisory HPESBNW05162 (2026-10-22) read: AOS-8 <=8.13.3.0 and <=8.10.0.23 affected, fixed 8.13.3.1 / 8.10.0.24. The advisory body I got was truncated before the per-CVE section for 79866, so the PAPI path traversal wording comes from the NVD description. HPE says no known public exploit or discussion. No social posts searched."},{"source":"analyst","external_id":"CVE-2026-79866:291","url":null,"severity":null,"published_at":"2026-10-23T22:45:17+00:00","modified_at":"2026-10-23T22:45:17+00:00","first_seen_at":"2026-10-23T22:45:17+00:00","fetched_at":"2026-10-23T22:45:17+00:00","note":"Read the CVE-2026-79866 section of HPESBNW05162 (title: Unauthenticated Adjacent Path Traversal leads to Filesystem Compromise in AOS-8; VULN-1123; CVSS 9.6, AV:A). The advisory does not say whether PAPI is on by default and names no port in this CVE's section. UDP 8211 is from sibling CVEs in the same bulletin (79860, 79878) and the AOS 8.10 docs (svc-papi udp 8211). The 2024 advisory's cluster-security / block-8211 workaround is for older CVEs; it is not confirmed for this one."},{"source":"epss","external_id":"CVE-2026-79866","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79866","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1595,"url":"https://arubanetworking.hpe.com/techdocs/ArubaOS_8.10.0_Web_Help/Content/arubaos-solutions/behavior-defaults/unde-basi-syst-defa.htm","title":"ArubaOS 8.10 Web Help: Understanding Basic System Defaults (svc-papi udp 8211)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1596,"url":"https://csaf.arubanetworking.hpe.com/2024/hpe_aruba_networking_-_hpesbnw04722.txt","title":"HPESBNW04722 (2024): earlier PAPI UDP 8211 advisory with cluster-security / block-8211 workaround","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}