{"id":"CVE-2026-79882","kind":"vulnerability","aliases":["CVE-2026-79882"],"related":[],"title":"AOS-10 PAPI protocol flaw lets adjacent attacker run code as root","description":"There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","summary":"Command injection in the PAPI protocol of AOS-10 (HPE Networking/Aruba). An unauthenticated attacker on an adjacent network can send crafted packets and run code as a privileged user on the device OS. CVSS 8.3. Fixed in 10.8.1.2, 10.7.2.7 and 10.4.1.14. HPE reports no public exploit or known exploitation.","severity":"high","cvss":8.3,"epss":0.00151,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":"10.8.x <= 10.8.1.1; 10.7.x <= 10.7.2.6; 10.4.x <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent","aos-10","aruba","command-injection","hpe","infrastructure","network-appliances","papi","unauthenticated"],"not_affected_if":["aos-8-only","patched-10.4.1.14","patched-10.7.2.7","patched-10.8.1.2"],"how_to_check":"Check the running AOS-10 version on each Mobility Conductor, Controller, Gateway and AOS-10 AP (for example 'show version' on the CLI, or the device list in HPE Networking Central). Affected if it is 10.8.1.1 or lower, 10.7.2.6 or lower, or 10.4.1.13 or lower. Versions past End of Maintenance are presumed affected.","fix":"Upgrade AOS-10 to 10.8.1.2 or later, 10.7.2.7 or later, or 10.4.1.14 or later (builds from networkingsupport.hpe.com). Until patched, restrict CLI and web management interfaces to a dedicated layer 2 VLAN and/or firewall them at layer 3 and above.","status":"open","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:02:06+00:00","updated_at":"2026-10-25T03:18:53+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:02:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AOS-10 PAPI protocol flaw lets adjacent attacker run code as root","impact":"high","summary":"AOS-10 has a command injection flaw in its PAPI protocol handling. An attacker on an adjacent network can send crafted packets to run arbitrary code as a privileged user on the underlying operating system, without logging in.","category":"infrastructure","nicknames":[],"who_cares":["aos-10","aruba","network-appliances"],"confidence":0.6,"needs_auth":"no","worst_case":"Arbitrary code runs as privileged user on the device OS","analyst_note":"Find the vendor advisory and the affected AOS-10 versions and patched builds; the NVD entry gives no version or fix details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000509,"input_tokens":3367,"output_tokens":345,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected AOS-10 versions and patched builds; the NVD entry gives no version or fix details.","search":"'-10':2A,20A,23B,43B,96C '-2026':14A,17A '-79882':15A,18A '10.4.1.14':75B '10.7.2.7':73B '10.8.1.2':72B '8.3':69B 'adjac':7A,21B,51B,107C 'allow':119C 'ao':1A,22B,42B,95C 'aos':19A 'applianc':32B 'arbitrari':124C 'aruba':24B 'attack':8A,48B,108C,121C 'code':10A,59B,103C,125C 'command':26B,35B,87C 'command-inject':25B 'could':98C,118C 'craft':55B,111C 'cve':13A,16A 'cvss':68B 'devic':66B 'execut':104C,123C 'exploit':80B,83B,114C 'fix':70B 'flaw':5A 'hpe':28B,44B,76B 'infrastructur':29B 'inject':27B,36B,88C 'known':82B 'lead':99C 'let':6A 'network':31B,52B 'network-appli':30B 'networking/aruba':45B 'oper':133C 'os':67B 'packet':56B,112C 'papi':3A,33B,39B,92C 'privileg':62B,128C 'protocol':4A,40B,93C 'public':79B 'remot':102C 'report':77B 'root':12A 'run':9A,58B 'send':54B,109C 'special':110C 'success':113C 'system':134C 'unauthent':34B,47B,101C 'under':132C 'user':63B,129C 'vulner':89C,117C","nicknames":[],"mitigations":[],"who_affected":"Anyone running HPE Networking/Aruba AOS-10 on Mobility Conductors, Controllers, Gateways or AOS-10 access points at 10.8.1.1, 10.7.2.6, 10.4.1.13 or older. The attacker must be on the same network segment as the device (adjacent), so exposure is highest where untrusted hosts or guest segments share a layer 2 with management and PAPI traffic. AOS-8-only deployments are not listed for this CVE; versions already at the fixed builds can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:18:53Z","by":"analyst","run_id":692},"products":{"at":"2026-10-25T03:18:53Z","by":"analyst","run_id":692},"workarounds":{"at":"2026-10-25T03:18:53Z","by":"analyst","run_id":692}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79882","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79882","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79882","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79882:692","url":null,"severity":null,"published_at":"2026-10-25T03:18:53+00:00","modified_at":"2026-10-25T03:18:53+00:00","first_seen_at":"2026-10-25T03:18:53+00:00","fetched_at":"2026-10-25T03:18:53+00:00","note":"Read HPE advisory HPESBNW05162 (Oct 22 2026): entry rated High 8.3, internal find VULN-1131, no known exploit or public PoC per vendor. Fixed builds taken from the vendor Resolution section. No X/community search done."}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}