{"id":"CVE-2026-79875","kind":"vulnerability","aliases":["CVE-2026-79875"],"related":[],"title":"Aruba AOS-8: unauthenticated attacker on the network gains administrator access","description":"A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","summary":"Authentication bypass in the PAPI protocol of HPE Networking AOS-8 (Aruba). An unauthenticated attacker on an adjacent network (CVSS 9.3, AV:A) can gain administrative access, change configuration and read or alter sensitive data. Fixed in AOS-8.13.3.1 and 8.10.0.24. HPE reports no public PoC or exploitation. PAPI is the AP management protocol on UDP 8211 (per secondary reports).","severity":"critical","cvss":9.3,"epss":0.00188,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","network-controller","papi","self-hosted"],"not_affected_if":["aos-10-only","unknown"],"how_to_check":"Check the AOS-8 version on each Mobility Conductor, Controller and Instant AP (show version). Affected: 8.13.x up to 8.13.3.0 and 8.10.x up to 8.10.0.23. Also check whether UDP 8211 (PAPI) and the CLI and web management interfaces can be reached from user or untrusted segments.","fix":"Upgrade to AOS-8.13.3.1 or later (8.13 train) or 8.10.0.24 or later (8.10 train); builds are on networkingsupport.hpe.com. Workaround: restrict CLI and web management to a dedicated L2 segment/VLAN and/or firewall at L3 and above. End-of-maintenance releases are presumed affected.","status":"open","published_at":"2026-10-22T19:17:59+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:46+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:31:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-8: unauthenticated attacker on the network gains administrator access","impact":"high","summary":"A flaw in the PAPI protocol of Aruba AOS-8 lets an unauthenticated attacker on an adjacent network bypass authentication. A successful attacker gains administrative access, can change system configuration, and can read or alter sensitive data.","category":"infrastructure","who_cares":["aos-8","aruba","network-controller","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker gains administrator access and can modify controller configuration and data.","analyst_note":"Find the affected AOS-8 versions and vendor advisory, and whether PAPI is exposed by default, at https://nvd.nist.gov/vuln/detail/CVE-2026-79875.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000479,"input_tokens":2941,"output_tokens":370,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected AOS-8 versions and vendor advisory, and whether PAPI is exposed by default, at https://nvd.nist.gov/vuln/detail/CVE-2026-79875.","search":"'-2026':13A,16A '-79875':14A,17A '-8':3A,21A,23B,44B,105C '8.10.0.24':74B '8.13.3.1':72B '8211':90B '9.3':54B 'access':11A,60B,128C,133C 'adjac':51B,112C 'administr':10A,59B,127C 'allow':109C,122C 'alter':66B 'ao':2A,22B,43B,71B,104C 'aos':20A 'ap':85B 'aruba':1A,24B,45B 'attack':5A,48B,113C,124C 'authent':34B,117C 'av':55B 'bypass':35B 'chang':61B 'circumv':115C 'configur':62B,131C 'control':29B,118C 'could':107C,121C 'cve':12A,15A 'cvss':53B 'data':68B,137C 'exist':116C 'exploit':81B,120C 'fix':69B 'gain':9A,58B,126C 'host':33B 'hpe':18A,25B,41B,75B 'identifi':98C 'infrastructur':26B 'manag':86B 'manipul':135C 'modifi':129C 'network':8A,28B,42B,52B 'network-control':27B 'networking':19A 'papi':30B,38B,82B,101C 'per':91B 'poc':79B 'potenti':108C 'protocol':39B,87B,102C 'public':78B 'read':64B 'report':76B,93B 'secondari':92B 'self':32B 'self-host':31B 'sensit':67B,136C 'success':119C 'system':130C 'udp':89B 'unauthent':4A,47B,111C 'vulner':95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79875","severity":null,"published_at":"2026-10-22T19:17:59+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79875:287","url":null,"severity":null,"published_at":"2026-10-23T22:44:23+00:00","modified_at":"2026-10-23T22:44:23+00:00","first_seen_at":"2026-10-23T22:44:23+00:00","fetched_at":"2026-10-23T22:44:23+00:00","note":"Vendor advisory HPESBNW05162 (22 Oct 2026) read via CSAF text; the per-CVE detail for 79875 was cut off in the fetch, so the affected range comes from the advisory's general list and the CVE record. HPE says no known PoC or exploitation. Whether PAPI is on by default is not confirmed in the pages I read."},{"source":"epss","external_id":"CVE-2026-79875","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79875","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1592,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79875","title":"CVE Record CVE-2026-79875 (affected ranges, CVSS 9.3 AV:A)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}