{"id":"CVE-2026-79883","kind":"vulnerability","aliases":["CVE-2026-79883"],"related":[],"title":"HPE AOS-10: PAPI protocol buffer overflow leaks data to adjacent attackers","description":"A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.","summary":"HPE Networking AOS-10 has a buffer overflow in its PAPI protocol handling. An unauthenticated attacker on an adjacent network can retrieve sensitive information and interrupt the service.","severity":"high","cvss":8.3,"epss":0.00176,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aos-10","hpe","infrastructure","network-gear","wireless"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-22T19:18:00+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:02:06+00:00","updated_at":"2026-10-25T03:02:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:02:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"HPE AOS-10: PAPI protocol buffer overflow leaks data to adjacent attackers","impact":"medium","summary":"HPE Networking AOS-10 has a buffer overflow in its PAPI protocol handling. An unauthenticated attacker on an adjacent network can retrieve sensitive information and interrupt the service.","category":"infrastructure","nicknames":[],"who_cares":["hpe","aos-10","network-gear","wireless"],"confidence":0.6,"needs_auth":"no","worst_case":"Sensitive data leaks and the service can be interrupted","analyst_note":"Find HPE's advisory for AOS-10 PAPI to get affected and fixed versions and any mitigation for the PAPI port; NVD record has no version or fix data here.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running HPE Networking AOS-10 on their wireless or network controllers and access points. Exposure depends on whether PAPI is reachable from the attacker's network segment. unknown whether specific AOS-10 versions or configurations are affected beyond what the NVD record states.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000567,"input_tokens":3384,"output_tokens":457,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-10':3A,20B,30B,67C,102C '-2026':14A,17A '-79883':15A,18A 'access':75C,95C 'adjac':11A,45B,72C 'affect':111C 'allow':69C,81C 'ao':2A,19B,29B,66C,101C 'attack':12A,42B,73C,83C 'buffer':6A,33B,56C 'could':68C,80C,88C 'cve':13A,16A 'data':9A 'exploit':79C 'gain':93C 'gear':25B 'handl':39B 'hpe':1A,21B,27B,64C 'inform':50B,77C,86C 'infrastructur':22B 'interrupt':52B,105C 'leak':8A 'network':24B,28B,46B,65C,97C 'network-gear':23B 'normal':107C 'oper':108C 'overflow':7A,34B,57C 'papi':4A,37B,61C 'potenti':92C 'protocol':5A,38B,62C 'retriev':48B,85C 'sensit':49B,76C 'servic':54B,98C,112C 'success':78C 'support':99C 'unauthent':41B,71C 'use':90C 'vulner':58C 'wireless':26B","nicknames":[],"mitigations":[],"who_affected":"Organisations running HPE Networking AOS-10 on their wireless or network controllers and access points. Exposure depends on whether PAPI is reachable from the attacker's network segment. unknown whether specific AOS-10 versions or configurations are affected beyond what the NVD record states.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79883","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79883","severity":null,"published_at":"2026-10-22T19:18:00+00:00","modified_at":"2026-10-23T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79883","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79883","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}