---
id: "CVE-2026-79878"
kind: "vulnerability"
aliases: ["CVE-2026-79878"]
title: "Alcatel-Lucent AOS-8: unauthenticated PAPI packets run code as root"
severity: "high"
cvss: 8.8
epss: 0.00801
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "papi", "rce", "self-hosted", "wireless-controller"]
not_affected_if: ["non-aos-8-hardware", "udp-8211-filtered", "unknown"]
published_at: "2026-10-22T19:18:00+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79878", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:39:45+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79878", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Alcatel-Lucent AOS-8: unauthenticated PAPI packets run code as root

Command injection in the AOS-8 CLI reached over PAPI (UDP 8211) lets an unauthenticated attacker on an adjacent network run shell commands on the controller. CVSS 8.8 (AV:A). HPE reports no exploitation and no public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE AOS-8 affected >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

Run 'show version' on each AOS-8 Mobility Conductor/Controller/Gateway. Affected: 8.12.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23. Check whether UDP 8211 (PAPI) and the CLI are reachable from untrusted segments.

## Fix

Upgrade AOS-8 to 8.13.3.1 or 8.10.0.24 or later (fixed versions inferred from the same HPE bulletin; confirm in HPESBNW05162). Until then, restrict CLI/web management and PAPI to a dedicated L2 segment/VLAN or L3+ firewall policy.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79878
- 2026-10-23T23:39:45+00:00 analyst — Part of HPESBNW05162 (2026-10-22). HPE page is JS-only; affected range from CNA data via controlassurance (8.12.0.0-8.13.3.0, 8.10.0.0-8.10.0.23); fixed 8.13.3.1/8.10.0.24 inferred from sibling CVEs in the same bulletin, not read per-CVE. CVSS 8.8 is adjacent (AV:A), not remote like siblings. No exploitation or PoC reported by HPE.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79878

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] CVE-2026-79878 - Threat Intelligence Index https://intel.controlassurance.com/cves/2026/79xxx/CVE-2026-79878.html
- [mitigation] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_