--- id: "CVE-2026-79866" kind: "vulnerability" aliases: ["CVE-2026-79866"] title: "HPE Aruba AOS-8: unauthenticated PAPI path traversal reads, edits, deletes OS files" severity: "critical" cvss: 9.6 epss: 0.00195 exploited: false status: "open" category: "infrastructure" products: [{"name": "HPE Networking AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": "8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-controller", "papi"] not_affected_if: ["aos-10-only", "fixed-version", "management-plane-isolated", "no-aos-8-deployment"] published_at: "2026-10-22T19:17:58+00:00" first_seen_at: "2026-10-23T21:57:32+00:00" updated_at: "2026-10-24T07:15:51+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79866", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:16:47+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:45:17+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79866", "first_seen_at": "2026-10-24T07:15:51+00:00"}] --- # HPE Aruba AOS-8: unauthenticated PAPI path traversal reads, edits, deletes OS files HPE Aruba AOS-8 controllers have a path traversal flaw in the PAPI protocol that needs no login. An attacker on an adjacent network can read, modify and delete files on the underlying operating system. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:HPE Networking AOS-8 affected 8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24 ## How to check Run 'show version' on the Mobility Conductor/Controller: affected if 8.13.x <= 8.13.3.0 or 8.10.x <= 8.10.0.23. PAPI is Aruba's AP-to-controller management protocol on UDP 8211 (predefined service svc-papi). HPE does not say whether it is enabled by default; assume it is reachable on controllers and check whether UDP 8211 is reachable from non-AP hosts on the same L2 segment/VLAN, since the attacker must be adjacent. ## Fix Upgrade AOS-8 8.13.x to 8.13.3.1 or 8.10.x to 8.10.0.24 or later. Only workaround in this bulletin: restrict CLI and web management interfaces to a dedicated L2 VLAN and/or firewall them at L3+. For earlier PAPI CVEs HPE also advised blocking UDP/8211 from untrusted networks and enabling cluster-security on Instant APs; HPE has not stated that applies here, so treat it as hardening only. ## Timeline - 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79866 - 2026-10-23T22:16:47+00:00 analyst — Vendor advisory HPESBNW05162 (2026-10-22) read: AOS-8 <=8.13.3.0 and <=8.10.0.23 affected, fixed 8.13.3.1 / 8.10.0.24. The advisory body I got was truncated before the per-CVE section for 79866, so the PAPI path traversal wording comes from the NVD description. HPE says no known public exploit or discussion. No social posts searched. - 2026-10-23T22:45:17+00:00 analyst — Read the CVE-2026-79866 section of HPESBNW05162 (title: Unauthenticated Adjacent Path Traversal leads to Filesystem Compromise in AOS-8; VULN-1123; CVSS 9.6, AV:A). The advisory does not say whether PAPI is on by default and names no port in this CVE's section. UDP 8211 is from sibling CVEs in the same bulletin (79860, 79878) and the AOS 8.10 docs (svc-papi udp 8211). The 2024 advisory's cluster-security / block-8211 workaround is for older CVEs; it is not confirmed for this one. - 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79866 ## Documents - [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt - [describes] ArubaOS 8.10 Web Help: Understanding Basic System Defaults (svc-papi udp 8211) https://arubanetworking.hpe.com/techdocs/ArubaOS_8.10.0_Web_Help/Content/arubaos-solutions/behavior-defaults/unde-basi-syst-defa.htm - [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/ - [mitigation] HPESBNW04722 (2024): earlier PAPI UDP 8211 advisory with cluster-security / block-8211 workaround https://csaf.arubanetworking.hpe.com/2024/hpe_aruba_networking_-_hpesbnw04722.txt ## From the sources An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_