---
id: "CVE-2026-79875"
kind: "vulnerability"
aliases: ["CVE-2026-79875"]
title: "Aruba AOS-8: unauthenticated attacker on the network gains administrator access"
severity: "critical"
cvss: 9.3
epss: 0.00188
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-controller", "papi", "self-hosted"]
not_affected_if: ["aos-10-only", "unknown"]
published_at: "2026-10-22T19:17:59+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79875", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:44:23+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79875", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-8: unauthenticated attacker on the network gains administrator access

Authentication bypass in the PAPI protocol of HPE Networking AOS-8 (Aruba). An unauthenticated attacker on an adjacent network (CVSS 9.3, AV:A) can gain administrative access, change configuration and read or alter sensitive data. Fixed in AOS-8.13.3.1 and 8.10.0.24. HPE reports no public PoC or exploitation. PAPI is the AP management protocol on UDP 8211 (per secondary reports).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking AOS-8 affected >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

Check the AOS-8 version on each Mobility Conductor, Controller and Instant AP (show version). Affected: 8.13.x up to 8.13.3.0 and 8.10.x up to 8.10.0.23. Also check whether UDP 8211 (PAPI) and the CLI and web management interfaces can be reached from user or untrusted segments.

## Fix

Upgrade to AOS-8.13.3.1 or later (8.13 train) or 8.10.0.24 or later (8.10 train); builds are on networkingsupport.hpe.com. Workaround: restrict CLI and web management to a dedicated L2 segment/VLAN and/or firewall at L3 and above. End-of-maintenance releases are presumed affected.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79875
- 2026-10-23T22:44:23+00:00 analyst — Vendor advisory HPESBNW05162 (22 Oct 2026) read via CSAF text; the per-CVE detail for 79875 was cut off in the fetch, so the affected range comes from the advisory's general list and the CVE record. HPE says no known PoC or exploitation. Whether PAPI is on by default is not confirmed in the pages I read.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79875

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] CVE Record CVE-2026-79875 (affected ranges, CVSS 9.3 AV:A) https://www.cve.org/CVERecord?id=CVE-2026-79875
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_