Live › vulnerability › CVE-2026-79955
Go to dashboardA memory corruption flaw in a service reached over the PAPI protocol in Aruba AOS-8 lets an unauthenticated remote attacker corrupt memory. The sources say the result is denial of service, disrupting the availability of the affected service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Aruba AOS-8 (Mobility Conductors, Controllers, Instant APs) on 8.10.0.0-8.10.0.23 or 8.13.0.0-8.13.3.0. An unauthenticated remote attacker who can reach the PAPI service (UDP 8211) can corrupt memory and crash the service, which is an availability impact only (CVSS 7.5). AOS-10-only deployments are not listed for this CVE. Networks that block PAPI and management access from untrusted segments are much less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ArubaOS (AOS-8) | vendor | >= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0 | 8.10.0.24, 8.13.3.1 |
show version8.13.3.0, or 8.10.x at or below 8.10.0.238.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train), or any later releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.
This page as .md · .json · in your agent: get_signal("CVE-2026-79955")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.