---
id: "CVE-2026-79882"
kind: "vulnerability"
aliases: ["CVE-2026-79882"]
title: "AOS-10 PAPI protocol flaw lets adjacent attacker run code as root"
severity: "high"
cvss: 8.3
epss: 0.00151
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": "10.8.x <= 10.8.1.1; 10.7.x <= 10.7.2.6; 10.4.x <= 10.4.1.13", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adjacent", "aos-10", "aruba", "command-injection", "hpe", "infrastructure", "network-appliances", "papi", "unauthenticated"]
not_affected_if: ["aos-8-only", "patched-10.4.1.14", "patched-10.7.2.7", "patched-10.8.1.2"]
published_at: "2026-10-22T19:18:00+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:18:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79882", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79882", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:18:53+00:00"}]
---

# AOS-10 PAPI protocol flaw lets adjacent attacker run code as root

Command injection in the PAPI protocol of AOS-10 (HPE Networking/Aruba). An unauthenticated attacker on an adjacent network can send crafted packets and run code as a privileged user on the device OS. CVSS 8.3. Fixed in 10.8.1.2, 10.7.2.7 and 10.4.1.14. HPE reports no public exploit or known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected 10.8.x <= 10.8.1.1; 10.7.x <= 10.7.2.6; 10.4.x <= 10.4.1.13 fixed 10.8.1.2, 10.7.2.7, 10.4.1.14

## How to check

Check the running AOS-10 version on each Mobility Conductor, Controller, Gateway and AOS-10 AP (for example 'show version' on the CLI, or the device list in HPE Networking Central). Affected if it is 10.8.1.1 or lower, 10.7.2.6 or lower, or 10.4.1.13 or lower. Versions past End of Maintenance are presumed affected.

## Fix

Upgrade AOS-10 to 10.8.1.2 or later, 10.7.2.7 or later, or 10.4.1.14 or later (builds from networkingsupport.hpe.com). Until patched, restrict CLI and web management interfaces to a dedicated layer 2 VLAN and/or firewall them at layer 3 and above.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79882
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79882
- 2026-10-25T03:18:53+00:00 analyst — Read HPE advisory HPESBNW05162 (Oct 22 2026): entry rated High 8.3, internal find VULN-1131, no known exploit or public PoC per vendor. Fixed builds taken from the vendor Resolution section. No X/community search done.

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [mentions] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_