---
id: "CVE-2026-79873"
kind: "vulnerability"
aliases: ["CVE-2026-79873"]
title: "HPE Aruba AOS-10: PAPI authentication bypass gives unauthenticated admin access"
severity: "critical"
cvss: 9.3
epss: 0.00199
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": ">= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-10", "aruba", "auth-bypass", "hpe", "infrastructure", "network-devices", "papi"]
not_affected_if: ["unaffected-version"]
published_at: "2026-10-22T19:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79873", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:14:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:44:02+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79873", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-10: PAPI authentication bypass gives unauthenticated admin access

HPE Aruba AOS-10 network devices have authentication bypass flaws in the PAPI protocol. An unauthenticated attacker on an adjacent network can gain administrative access, change device configuration, and read or alter sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected >= 10.8.0.0, <= 10.8.1.1; >= 10.7.0.0, <= 10.7.2.6; >= 10.4.0.0, <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Run 'show version' on each AOS-10 Conductor, Controller, Gateway and AP (or look in Central). Affected: 10.8.0.0-10.8.1.1, 10.7.x up to 10.7.2.6, 10.4.x up to 10.4.1.13 (bulletin also lists the 10.6 and 10.3 branches). PAPI is on by default, so assume exposed if the device is on an affected version. To see reachability, check that UDP 8211 is not open from guest, user or other untrusted segments, for example with a UDP scan of 8211 from those segments. Adjacent-network only (AV:A), so routed internet exposure matters less than same-LAN/Wi-Fi exposure.

## Fix

Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14 or later. Until then, allow UDP 8211 only between your own APs, controllers and gateways, and restrict CLI/web management to a dedicated L2 segment/VLAN or firewall. PAPI cannot be turned off; cluster-security is not available on AOS-10 per HPE's 2024 advisories.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79873
- 2026-10-23T22:14:27+00:00 analyst — Part of HPE bulletin HPESBNW05162 (22 Oct 2026), inferred from same CNA (HPE), date and PAPI/AOS-10 wording; HPE page text unreadable by web-cli and no source I read names this CVE id, so versions come from the bulletin-wide list (securityonline, cybersecuritynews). HPE: no exploitation, no public PoC, not in KEV. No X/social search done.
- 2026-10-23T22:44:02+00:00 analyst — Added how-to-check. Default exposure: PAPI (UDP 8211) is how APs/controllers talk, so it is on by default and the default session ACL permits svc-papi; HPE's 2024 PAPI advisories say cluster-security is not an option on AOS-10 and the workaround is restricting UDP/8211. The 2026 bulletin text is still unreadable and no source names this CVE id, so the check is inferred from earlier advisories and the bulletin-wide list.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79873

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] HPE Networking AOS Vulnerabilities Hit PAPI Protocol https://securityonline.info/hpe-networking-aos-vulnerabilities/
- [mentions] OpenCVE: CVE-2026-79873 https://app.opencve.io/cve/CVE-2026-79873
- [mitigation] HPESBNW04712 (2024): earlier PAPI UDP 8211 advisory, AOS-10 workaround https://csaf.arubanetworking.hpe.com/2024/hpe_aruba_networking_-_hpesbnw04712.txt

## From the sources

Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_