{"id":"CVE-2026-79873","kind":"vulnerability","aliases":["CVE-2026-79873"],"related":[],"title":"HPE Aruba AOS-10: PAPI authentication bypass gives unauthenticated admin access","description":"Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.","summary":"HPE Aruba AOS-10 network devices have authentication bypass flaws in the PAPI protocol. An unauthenticated attacker on an adjacent network can gain administrative access, change device configuration, and read or alter sensitive data.","severity":"critical","cvss":9.3,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aruba","auth-bypass","hpe","infrastructure","network-devices","papi"],"not_affected_if":["unaffected-version"],"how_to_check":"Run 'show version' on each AOS-10 Conductor, Controller, Gateway and AP (or look in Central). Affected: 10.8.0.0-10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13 (bulletin also lists the 10.6 and 10.3 branches). PAPI is on by default, so assume exposed if the device is on an affected version. To see reachability, check that UDP 8211 is not open from guest, user or other untrusted segments, for example with a UDP scan of 8211 from those segments. Adjacent-network only (AV:A), so routed internet exposure matters less than same-LAN/Wi-Fi exposure.","fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later. Until then, allow UDP 8211 only between your own APs, controllers and gateways, and restrict CLI/web management to a dedicated L2 segment/VLAN or firewall. PAPI cannot be turned off; cluster-security is not available on AOS-10 per HPE's 2024 advisories.","status":"open","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:47+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:31:47Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to AOS-10 10.8.1.2, 10.7.2.7, or 10.4.1.14, matching the installed branch.","reach":"network","title":"HPE Aruba AOS-10: PAPI authentication bypass gives unauthenticated admin access","impact":"high","summary":"HPE Aruba AOS-10 network devices have authentication bypass flaws in the PAPI protocol. An unauthenticated attacker on an adjacent network can gain administrative access, change device configuration, and read or alter sensitive data.","category":"infrastructure","who_cares":["aos-10","aruba","hpe","network-devices"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker gains administrative control of the network device","analyst_note":"Confirm the PAPI service exposure default and a way to detect it on affected AOS-10 devices; check the HPE advisory for the exact check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unaffected-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000505,"input_tokens":3067,"output_tokens":397,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the PAPI service exposure default and a way to detect it on affected AOS-10 devices; check the HPE advisory for the exact check.","search":"'-10':4A,19A,21B,35B,75C '-2026':13A,16A '-79873':14A,17A 'access':11A,56B,96C,101C 'adjac':51B,80C 'admin':10A 'administr':55B,95C 'affect':107C 'allow':77C,90C 'alter':63B 'ao':3A,20B,34B,74C 'aos':18A 'aruba':2A,22B,33B 'attack':48B,81C,92C 'auth':24B 'auth-bypass':23B 'authent':6A,39B,66C,85C 'bypass':7A,25B,40B,67C 'chang':57B 'circumv':83C 'configur':59B,99C 'control':86C 'could':76C,89C 'cve':12A,15A 'data':65B,105C 'devic':30B,37B,58B,108C 'exist':84C 'exploit':88C 'flaw':41B 'gain':54B,94C 'give':8A 'hpe':1A,26B,32B 'infrastructur':27B 'manipul':103C 'modifi':97C 'network':29B,36B,52B 'network-devic':28B 'papi':5A,31B,44B,71C 'protocol':45B,72C 'read':61B 'sensit':64B,104C 'success':87C 'system':98C 'unauthent':9A,47B,79C 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79873","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:24+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79873:187","url":null,"severity":null,"published_at":"2026-10-23T22:14:27+00:00","modified_at":"2026-10-23T22:14:27+00:00","first_seen_at":"2026-10-23T22:14:27+00:00","fetched_at":"2026-10-23T22:14:27+00:00","note":"Part of HPE bulletin HPESBNW05162 (22 Oct 2026), inferred from same CNA (HPE), date and PAPI/AOS-10 wording; HPE page text unreadable by web-cli and no source I read names this CVE id, so versions come from the bulletin-wide list (securityonline, cybersecuritynews). HPE: no exploitation, no public PoC, not in KEV. No X/social search done."},{"source":"analyst","external_id":"CVE-2026-79873:288","url":null,"severity":null,"published_at":"2026-10-23T22:44:02+00:00","modified_at":"2026-10-23T22:44:02+00:00","first_seen_at":"2026-10-23T22:44:02+00:00","fetched_at":"2026-10-23T22:44:02+00:00","note":"Added how-to-check. Default exposure: PAPI (UDP 8211) is how APs/controllers talk, so it is on by default and the default session ACL permits svc-papi; HPE's 2024 PAPI advisories say cluster-security is not an option on AOS-10 and the workaround is restricting UDP/8211. The 2026 bulletin text is still unreadable and no source names this CVE id, so the check is inferred from earlier advisories and the bulletin-wide list."},{"source":"epss","external_id":"CVE-2026-79873","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79873","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1338,"url":"https://securityonline.info/hpe-networking-aos-vulnerabilities/","title":"HPE Networking AOS Vulnerabilities Hit PAPI Protocol","kind":"blog","source":"analyst","text":"CVE-2026-79861 brings the same command-injection bug type as CVE-2026-79857 to AOS-10. PAPI listens on UDP 8211. Affected: AOS-10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13. Upgrade to 10.8.1.2, 10.7.2.7 or 10.4.1.14. Limit UDP 8211 to trusted devices.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1339,"url":"https://app.opencve.io/cve/CVE-2026-79873","title":"OpenCVE: CVE-2026-79873","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1586,"url":"https://csaf.arubanetworking.hpe.com/2024/hpe_aruba_networking_-_hpesbnw04712.txt","title":"HPESBNW04712 (2024): earlier PAPI UDP 8211 advisory, AOS-10 workaround","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}