{"id":"CVE-2026-79886","kind":"vulnerability","aliases":["CVE-2026-79886"],"related":[],"title":"Aruba AOS-8 controllers: unauthenticated PAPI buffer overflow disrupts service","description":"An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.","summary":"An unauthenticated buffer overflow in the PAPI protocol of Aruba AOS-8 wireless controllers lets a remote attacker crash or disrupt the affected service. The sources describe limited integrity impact and do not say that code execution is possible.","severity":"high","cvss":8.2,"epss":0.00229,"exploited":false,"exploited_at":null,"products":[{"name":"ArubaOS (AOS-8)","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","hpe","infrastructure","papi","wireless-controllers"],"not_affected_if":["aos-10-only","papi-restricted"],"how_to_check":"On each Mobility Conductor, Controller and AOS-8 Instant AP run 'show version'. Exposed if it reports 8.13.x or 8.12.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. Also check whether PAPI (UDP 8211) is reachable from untrusted networks. Whether PAPI is enabled by default is not stated in the sources.","fix":"Upgrade AOS-8 to 8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train), or later. Fixed versions per press coverage of HPESBNW05162, not read on the HPE page. 8.12 has no listed fix; move to a fixed 8.13 release.","status":"open","published_at":"2026-10-22T19:18:01+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:03:38+00:00","updated_at":"2026-10-25T03:18:31+00:00","category":"infrastructure","confidence":0.65,"triage":{"at":"2026-10-25T03:03:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-8 controllers: unauthenticated PAPI buffer overflow disrupts service","impact":"medium","summary":"An unauthenticated buffer overflow in the PAPI protocol of Aruba AOS-8 wireless controllers lets a remote attacker crash or disrupt the affected service. The sources describe limited integrity impact and do not say that code execution is possible.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","aruba","wireless-controllers"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker disrupts controller service, with limited integrity impact","analyst_note":"Find the vendor advisory and the affected and fixed AOS-8 versions, and whether PAPI is enabled by default, using the NVD reference for CVE-2026-79886.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"AOS-8 wireless controllers that expose the PAPI protocol to the network are the systems to look at. The sources do not list affected versions or say whether PAPI is enabled by default, so unknown whether a given controller is exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000562,"input_tokens":3342,"output_tokens":455,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected and fixed AOS-8 versions, and whether PAPI is enabled by default, using the NVD reference for CVE-2026-79886.","search":"'-2026':12A,15A '-79886':13A,16A '-8':3A,19A,21B,40B,80C 'affect':51B,95C 'allow':84C 'ao':2A,20B,39B,79C 'aos':18A 'aruba':1A,22B,38B 'arubaos':17A 'attack':46B,88C 'avail':92C 'buffer':7A,31B,70C 'code':64B 'control':4A,28B,42B,99C 'could':83C 'crash':47B 'cve':11A,14A 'describ':55B 'disrupt':9A,49B,90C 'execut':65B 'exist':73C 'exploit':82C 'hpe':23B 'impact':58B,103C 'infrastructur':24B 'integr':57B,106C 'let':43B 'limit':56B,102C 'overflow':8A,32B,71C 'papi':6A,25B,35B,76C 'possibl':67B 'protocol':36B,77C 'remot':45B,87C 'say':62B 'servic':10A,52B,96C 'sourc':54B 'success':81C 'unauthent':5A,30B,69C,86C 'vulner':72C 'wireless':27B,41B 'wireless-control':26B","nicknames":[],"mitigations":[],"who_affected":"AOS-8 wireless controllers that expose the PAPI protocol to the network are the systems to look at. The sources do not list affected versions or say whether PAPI is enabled by default, so unknown whether a given controller is exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79886","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79886","severity":null,"published_at":"2026-10-22T19:18:01+00:00","modified_at":"2026-10-23T20:17:26+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79886","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79886","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79886:691","url":null,"severity":null,"published_at":"2026-10-25T03:18:31+00:00","modified_at":"2026-10-25T03:18:31+00:00","first_seen_at":"2026-10-25T03:18:31+00:00","fetched_at":"2026-10-25T03:18:31+00:00","note":"Part of HPE advisory HPESBNW05162 (Oct 22 2026). HPE page is JS-only, unreadable, so nothing marked verified. Affected ranges from the CNA record on cve.org (note 8.12.0.0 start differs from sibling CVEs, which start 8.13.0.0). Fixed versions 8.13.3.1 / 8.10.0.24 and mitigation come from press coverage of the same advisory via the sibling CVE-2026-79955, not per-CVE vendor text. PAPI UDP 8211 from sibling CVE-2026-79860 record. Default-enabled status unknown. No exploitation or PoC reported."}],"documents":[{"id":3109,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79886","title":"CVE Record: CVE-2026-79886","kind":"advisory","source":"analyst","text":"CNA record (HPE). PAPI unauthenticated buffer overflow, CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. Affected from 8.12.0.0 through 8.13.3.0; affected from 8.10.0.0 through 8.10.0.23. Reference: HPESBNW05162. Internal research by HPE Networking.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1279,"url":"https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/","title":"Critical HPE Aruba AOS-8 Vulnerability (cyberpress)","kind":"blog","source":"analyst","text":"Secondary. Fixed: AOS-8 8.13.3.1 or 8.10.0.24. Mitigation: restrict CLI/web mgmt to dedicated L2 VLAN, L3+ firewall. No known public discussion or exploit as of bulletin.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}