---
id: "CVE-2026-79870"
kind: "vulnerability"
aliases: ["CVE-2026-79870"]
title: "HPE Aruba AOS-8: PAPI authentication bypass gives unauthenticated admin access"
severity: "critical"
cvss: 9.6
epss: 0.0022
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe", "infrastructure", "papi", "self-hosted", "wireless-controller"]
not_affected_if: ["default-config"]
published_at: "2026-10-22T19:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79870", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:15:49+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:45:00+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79870", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-8: PAPI authentication bypass gives unauthenticated admin access

AOS-8 wireless controllers have an authentication bypass in the PAPI protocol. An unauthenticated attacker on an adjacent network can get administrative access, change configuration and read or alter sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-8 affected >= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

1) show version: exposed if 8.13.0.0-8.13.3.0 or 8.10.0.0-8.10.0.23. 2) PAPI (UDP 8211) is how controllers and APs talk, so assume it is listening. Confirm with show papi kernel-socket-stats and show firewall (svc-papi). 3) Review which adjacent L2 segments and VLANs can reach UDP 8211, and whether papi-security enhanced-security is enabled (show running-config | include papi-security). Enhanced security is not documented by HPE as a mitigation for this CVE.

## Fix

Upgrade AOS-8 to 8.13.3.1 (8.13 branch) or 8.10.0.24 (8.10 branch). Until then, restrict UDP 8211 and CLI/web management to trusted segments with VLAN/firewall controls, per HPE.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79870
- 2026-10-23T22:15:49+00:00 analyst — HPE bulletin HPESBNW05162 (Oct 22) is JS-only, so versions come from cve.org record and press reading it; fixed versions via cybersecuritynews, not read on HPE page directly. HPE: no known PoC or exploitation. Did not search social posts.
- 2026-10-23T22:45:00+00:00 analyst — PAPI is core controller/AP and conductor/managed-device control traffic on UDP 8211 (predefined svc-papi in AOS-8 docs), so treat it as on by default; I found no off switch. Triage's not-affected-if default-config looks wrong: do not skip on that basis. papi-security enhanced-security defaults to Disable, but HPE has not said it mitigates this CVE. HPE bulletin still unread directly.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79870

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] CVE Record: CVE-2026-79870 https://www.cve.org/CVERecord?id=CVE-2026-79870
- [fix] HPE Warns Critical Aruba Networking Flaws https://cybersecuritynews.com/hpe-warns-aruba-networking-flaws/
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_