Live › vulnerability › CVE-2026-79882
Go to dashboardCommand injection in the PAPI protocol of AOS-10 (HPE Networking/Aruba). An unauthenticated attacker on an adjacent network can send crafted packets and run code as a privileged user on the device OS. CVSS 8.3. Fixed in 10.8.1.2, 10.7.2.7 and 10.4.1.14. HPE reports no public exploit or known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running HPE Networking/Aruba AOS-10 on Mobility Conductors, Controllers, Gateways or AOS-10 access points at 10.8.1.1, 10.7.2.6, 10.4.1.13 or older. The attacker must be on the same network segment as the device (adjacent), so exposure is highest where untrusted hosts or guest segments share a layer 2 with management and PAPI traffic. AOS-8-only deployments are not listed for this CVE; versions already at the fixed builds can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-10 | vendor | 10.8.x <= 10.8.1.1; 10.7.x <= 10.7.2.6; 10.4.x <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
show version on the CLI, or the device list in HPE Networking Central)10.8.1.1 or lower, 10.7.2.6 or lower, or 10.4.1.13 or lower10.8.1.2 or later, 10.7.2.7 or later, or 10.4.1.14 or later (builds from networkingsupport.hpe.com)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79882")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.