---
id: "CVE-2026-79886"
kind: "vulnerability"
aliases: ["CVE-2026-79886"]
title: "Aruba AOS-8 controllers: unauthenticated PAPI buffer overflow disrupts service"
severity: "high"
cvss: 8.2
epss: 0.00229
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ArubaOS (AOS-8)", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aos-8", "aruba", "hpe", "infrastructure", "papi", "wireless-controllers"]
not_affected_if: ["aos-10-only", "papi-restricted"]
published_at: "2026-10-22T19:18:01+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:18:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79886", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79886", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:18:31+00:00"}]
---

# Aruba AOS-8 controllers: unauthenticated PAPI buffer overflow disrupts service

An unauthenticated buffer overflow in the PAPI protocol of Aruba AOS-8 wireless controllers lets a remote attacker crash or disrupt the affected service. The sources describe limited integrity impact and do not say that code execution is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ArubaOS (AOS-8) affected >= 8.12.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed 8.13.3.1, 8.10.0.24

## How to check

On each Mobility Conductor, Controller and AOS-8 Instant AP run 'show version'. Exposed if it reports 8.13.x or 8.12.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. Also check whether PAPI (UDP 8211) is reachable from untrusted networks. Whether PAPI is enabled by default is not stated in the sources.

## Fix

Upgrade AOS-8 to 8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train), or later. Fixed versions per press coverage of HPESBNW05162, not read on the HPE page. 8.12 has no listed fix; move to a fixed 8.13 release.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79886
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79886
- 2026-10-25T03:18:31+00:00 analyst — Part of HPE advisory HPESBNW05162 (Oct 22 2026). HPE page is JS-only, unreadable, so nothing marked verified. Affected ranges from the CNA record on cve.org (note 8.12.0.0 start differs from sibling CVEs, which start 8.13.0.0). Fixed versions 8.13.3.1 / 8.10.0.24 and mitigation come from press coverage of the same advisory via the sibling CVE-2026-79955, not per-CVE vendor text. PAPI UDP 8211 from sibling CVE-2026-79860 record. Default-enabled status unknown. No exploitation or PoC reported.

## Documents

- [advisory] CVE Record: CVE-2026-79886 https://www.cve.org/CVERecord?id=CVE-2026-79886
- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] Critical HPE Aruba AOS-8 Vulnerability (cyberpress) https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/

## From the sources

An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_