Live › vulnerability › CVE-2026-79878
Go to dashboardCommand injection in the AOS-8 CLI reached over PAPI (UDP 8211) lets an unauthenticated attacker on an adjacent network run shell commands on the controller. CVSS 8.8 (AV:A). HPE reports no exploitation and no public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| HPE AOS-8 | vendor | >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
show version on each AOS-8 Mobility Conductor/Controller/Gateway8.12.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.238.13.3.1 or 8.10.0.24 or later (fixed versions inferred from the same HPE bulletin; confirm in HPESBNW05162)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79878")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.