Live › vulnerability › CVE-2026-79890
Go to dashboardAOS-8 controllers have command injection flaws in the PAPI protocol handling. A remote attacker who sends specially crafted PAPI packets can execute arbitrary code as a privileged user on the underlying operating system, with no login needed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Aruba AOS-8 wireless controllers or gateways that accept PAPI traffic from the network. Sources do not list affected versions or whether the PAPI port is reachable by default, so unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79890")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.