{"id":"CVE-2026-79955","kind":"vulnerability","aliases":["CVE-2026-79955"],"related":[],"title":"Aruba AOS-8: unauthenticated PAPI memory corruption lets remote attackers crash services","description":"An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.","summary":"A memory corruption flaw in a service reached over the PAPI protocol in Aruba AOS-8 lets an unauthenticated remote attacker corrupt memory. The sources say the result is denial of service, disrupting the availability of the affected service.","severity":"high","cvss":7.5,"epss":0.00338,"exploited":false,"exploited_at":null,"products":[{"name":"ArubaOS (AOS-8)","fixed":["8.10.0.24","8.13.3.1"],"affected":">= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","hpe","infrastructure","network-appliance","papi","wireless"],"not_affected_if":["aos-10-only","papi-restricted","unknown"],"how_to_check":"On each Mobility Conductor, Controller and AOS-8 Instant AP, run 'show version'. You are exposed if it reports 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. Also check whether UDP 8211 (PAPI) is reachable from untrusted networks. Releases past end of maintenance are presumed affected.","fix":"Upgrade AOS-8 to 8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train), or any later release. Fixed versions are as reported by press coverage of HPESBNW05162.","status":"open","published_at":"2026-10-22T19:18:02+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:15:03+00:00","updated_at":"2026-10-25T03:17:38+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:15:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-8: unauthenticated PAPI memory corruption lets remote attackers crash services","impact":"medium","summary":"A memory corruption flaw in a service reached over the PAPI protocol in Aruba AOS-8 lets an unauthenticated remote attacker corrupt memory. The sources say the result is denial of service, disrupting the availability of the affected service.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","aruba","network-appliance"],"confidence":0.5,"needs_auth":"no","worst_case":"Remote unauthenticated attacker crashes the PAPI-accessed service, causing denial of service","analyst_note":"Find the vendor advisory for CVE-2026-79955 to get affected and fixed AOS-8 versions and the PAPI port; the NVD text alone gives no version or fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"AOS-8 wireless controller deployments that expose the PAPI service to the network. The sources do not say which AOS-8 versions or configurations are affected, so check the vendor advisory before assuming a version is safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000566,"input_tokens":3359,"output_tokens":460,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory for CVE-2026-79955 to get affected and fixed AOS-8 versions and the PAPI port; the NVD text alone gives no version or fix.","search":"'-2026':14A,17A '-79955':15A,18A '-8':3A,21A,23B,47B,87C 'access':80C 'affect':69B,114C 'allow':90C,105C 'ao':2A,22B,46B,86C 'aos':20A 'applianc':29B 'aruba':1A,24B,45B 'arubaos':19A 'attack':10A,52B,94C,101C,107C 'avail':66B,111C 'conduct':96C 'corrupt':7A,34B,53B,74C 'could':89C,104C 'crash':11A 'cve':13A,16A 'denial':61B,98C 'disrupt':64B,109C 'exist':76C 'exploit':103C 'flaw':35B 'hpe':25B 'infrastructur':26B 'let':8A,48B 'memori':6A,33B,54B,73C 'network':28B 'network-appli':27B 'papi':5A,30B,42B,83C 'protocol':43B,84C 'reach':39B 'remot':9A,51B,93C 'result':59B 'say':57B 'servic':12A,38B,63B,70B,79C,100C,115C 'sourc':56B 'success':102C 'unauthent':4A,50B,72C,92C 'via':81C 'vulner':75C 'wireless':31B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Aruba AOS-8 (Mobility Conductors, Controllers, Instant APs) on 8.10.0.0-8.10.0.23 or 8.13.0.0-8.13.3.0. An unauthenticated remote attacker who can reach the PAPI service (UDP 8211) can corrupt memory and crash the service, which is an availability impact only (CVSS 7.5). AOS-10-only deployments are not listed for this CVE. Networks that block PAPI and management access from untrusted segments are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79955","severity":null,"published_at":"2026-10-22T19:18:02+00:00","modified_at":"2026-10-23T20:17:27+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-79955","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79955","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79955:688","url":null,"severity":null,"published_at":"2026-10-25T03:17:38+00:00","modified_at":"2026-10-25T03:17:38+00:00","first_seen_at":"2026-10-25T03:17:38+00:00","fetched_at":"2026-10-25T03:17:38+00:00","note":"Part of HPE advisory HPESBNW05162 (Oct 22 2026, 72 CVEs). The HPE page is JS-only and returned no text, so nothing is marked verified. Affected ranges come from the CNA record (via SecHOT). Fixed versions and the PAPI port 8211 come from two press write-ups of the advisory. No exploitation or public PoC reported."}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1279,"url":"https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/","title":"Critical HPE Aruba AOS-8 Vulnerability (cyberpress)","kind":"blog","source":"analyst","text":"Secondary. Fixed: AOS-8 8.13.3.1 or 8.10.0.24. Mitigation: restrict CLI/web mgmt to dedicated L2 VLAN, L3+ firewall. No known public discussion or exploit as of bulletin.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1376,"url":"https://dailysecurityreview.com/resources/hpe-patches-72-aruba-aos-8-and-aos-10-flaws-eight-at-cvss-10-0/","title":"HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws","kind":"blog","source":"analyst","text":"HPE reported no exploitation and no public PoC; none in CISA KEV.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}