{"id":"CVE-2026-79870","kind":"vulnerability","aliases":["CVE-2026-79870"],"related":[],"title":"HPE Aruba AOS-8: PAPI authentication bypass gives unauthenticated admin access","description":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.","summary":"AOS-8 wireless controllers have an authentication bypass in the PAPI protocol. An unauthenticated attacker on an adjacent network can get administrative access, change configuration and read or alter sensitive data.","severity":"critical","cvss":9.6,"epss":0.0022,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","papi","self-hosted","wireless-controller"],"not_affected_if":["default-config"],"how_to_check":"1) show version: exposed if 8.13.0.0-8.13.3.0 or 8.10.0.0-8.10.0.23. 2) PAPI (UDP 8211) is how controllers and APs talk, so assume it is listening. Confirm with show papi kernel-socket-stats and show firewall (svc-papi). 3) Review which adjacent L2 segments and VLANs can reach UDP 8211, and whether papi-security enhanced-security is enabled (show running-config | include papi-security). Enhanced security is not documented by HPE as a mitigation for this CVE.","fix":"Upgrade AOS-8 to 8.13.3.1 (8.13 branch) or 8.10.0.24 (8.10 branch). Until then, restrict UDP 8211 and CLI/web management to trusted segments with VLAN/firewall controls, per HPE.","status":"open","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:49+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T22:31:49Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-8 to 8.13.3.1 (for the 8.13 branch) or 8.10.0.24 (for the 8.10 branch).","reach":"network","title":"HPE Aruba AOS-8: PAPI authentication bypass gives unauthenticated admin access","impact":"high","summary":"AOS-8 wireless controllers have an authentication bypass in the PAPI protocol. An unauthenticated attacker on an adjacent network can get administrative access, change configuration and read or alter sensitive data.","category":"infrastructure","who_cares":["aos-8","aruba","wireless-controller","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gains administrative control of the wireless controller and its configuration.","analyst_note":"Confirm whether PAPI is enabled by default and how to check for it on AOS-8 controllers; source URL https://nvd.nist.gov/vuln/detail/CVE-2026-79870 gives no detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000516,"input_tokens":3036,"output_tokens":424,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether PAPI is enabled by default and how to check for it on AOS-8 controllers; source URL https://nvd.nist.gov/vuln/detail/CVE-2026-79870 gives no detection steps.","search":"'-2026':13A,16A '-79870':14A,17A '-8':4A,19A,21B,33B,73C 'access':11A,54B,94C,98C 'adjac':49B,78C 'admin':10A 'administr':53B,93C 'allow':75C,88C 'alter':60B 'ao':3A,20B,32B,72C 'aos':18A 'aruba':2A,22B 'attack':46B,79C,90C 'authent':6A,38B,64C,83C 'bypass':7A,39B,65C 'chang':55B 'circumv':81C 'configur':56B,97C 'control':31B,35B,84C 'could':74C,87C 'cve':12A,15A 'data':62B,102C 'disrupt':104C 'exist':82C 'exploit':86C 'gain':92C 'get':52B 'give':8A 'host':28B 'hpe':1A,23B 'infrastructur':24B 'manipul':100C 'modifi':95C 'network':50B,105C 'oper':106C 'papi':5A,25B,42B,69C 'protocol':43B,70C 'read':58B 'self':27B 'self-host':26B 'sensit':61B,101C 'success':85C 'system':96C 'unauthent':9A,45B,77C 'vulner':66C 'wireless':30B,34B 'wireless-control':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79870","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79870","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79870:190","url":null,"severity":null,"published_at":"2026-10-23T22:15:49+00:00","modified_at":"2026-10-23T22:15:49+00:00","first_seen_at":"2026-10-23T22:15:49+00:00","fetched_at":"2026-10-23T22:15:49+00:00","note":"HPE bulletin HPESBNW05162 (Oct 22) is JS-only, so versions come from cve.org record and press reading it; fixed versions via cybersecuritynews, not read on HPE page directly. HPE: no known PoC or exploitation. Did not search social posts."},{"source":"analyst","external_id":"CVE-2026-79870:289","url":null,"severity":null,"published_at":"2026-10-23T22:45:00+00:00","modified_at":"2026-10-23T22:45:00+00:00","first_seen_at":"2026-10-23T22:45:00+00:00","fetched_at":"2026-10-23T22:45:00+00:00","note":"PAPI is core controller/AP and conductor/managed-device control traffic on UDP 8211 (predefined svc-papi in AOS-8 docs), so treat it as on by default; I found no off switch. Triage's not-affected-if default-config looks wrong: do not skip on that basis. papi-security enhanced-security defaults to Disable, but HPE has not said it mitigates this CVE. HPE bulletin still unread directly."},{"source":"epss","external_id":"CVE-2026-79870","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79870","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1353,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79870","title":"CVE Record: CVE-2026-79870","kind":"other","source":"analyst","text":"PAPI auth bypass in AOS-8, unauthenticated adjacent attacker. CVSS 3.1 9.6 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Affected 8.13.0.0-8.13.3.0, 8.10.0.0-8.10.0.23.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1356,"url":"https://cybersecuritynews.com/hpe-warns-aruba-networking-flaws/","title":"HPE Warns Critical Aruba Networking Flaws","kind":"blog","source":"analyst","text":"Fixed: AOS-8.13.3.1, AOS-8.10.0.24 (AOS-10: 10.8.1.2, 10.7.2.7, 10.4.1.14). Affected AOS-8 8.13.3.0 and 8.10.0.23 and earlier. Mitigation: restrict CLI/web management to dedicated L2 segment/VLAN with firewall. PAPI uses UDP 8211. HPE knows of no public PoC or exploitation.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}