Live › vulnerability › CVE-2026-79875
Go to dashboardAuthentication bypass in the PAPI protocol of HPE Networking AOS-8 (Aruba). An unauthenticated attacker on an adjacent network (CVSS 9.3, AV:A) can gain administrative access, change configuration and read or alter sensitive data. Fixed in AOS-8.13.3.1 and 8.10.0.24. HPE reports no public PoC or exploitation. PAPI is the AP management protocol on UDP 8211 (per secondary reports).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HPE Networking AOS-8 | vendor | >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
8.13.3.0 and 8.10.x up to 8.10.0.238.10.0.24 or later (8.10 train); builds are on networkingsupport.hpe.comEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
This page as .md · .json · in your agent: get_signal("CVE-2026-79875")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.