---
id: "CVE-2026-79883"
kind: "vulnerability"
aliases: ["CVE-2026-79883"]
title: "HPE AOS-10: PAPI protocol buffer overflow leaks data to adjacent attackers"
severity: "high"
cvss: 8.3
epss: 0.00176
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aos-10", "hpe", "infrastructure", "network-gear", "wireless"]
not_affected_if: ["unknown"]
published_at: "2026-10-22T19:18:00+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:02:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79883", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79883", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE AOS-10: PAPI protocol buffer overflow leaks data to adjacent attackers

HPE Networking AOS-10 has a buffer overflow in its PAPI protocol handling. An unauthenticated attacker on an adjacent network can retrieve sensitive information and interrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79883
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79883

## From the sources

A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_