---
id: "CVE-2026-79955"
kind: "vulnerability"
aliases: ["CVE-2026-79955"]
title: "Aruba AOS-8: unauthenticated PAPI memory corruption lets remote attackers crash services"
severity: "high"
cvss: 7.5
epss: 0.00338
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ArubaOS (AOS-8)", "fixed": ["8.10.0.24", "8.13.3.1"], "affected": ">= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "papi", "wireless"]
not_affected_if: ["aos-10-only", "papi-restricted", "unknown"]
published_at: "2026-10-22T19:18:02+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:17:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79955", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79955", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:17:38+00:00"}]
---

# Aruba AOS-8: unauthenticated PAPI memory corruption lets remote attackers crash services

A memory corruption flaw in a service reached over the PAPI protocol in Aruba AOS-8 lets an unauthenticated remote attacker corrupt memory. The sources say the result is denial of service, disrupting the availability of the affected service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ArubaOS (AOS-8) affected >= 8.10.0.0, <= 8.10.0.23; >= 8.13.0.0, <= 8.13.3.0 fixed 8.10.0.24, 8.13.3.1

## How to check

On each Mobility Conductor, Controller and AOS-8 Instant AP, run 'show version'. You are exposed if it reports 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. Also check whether UDP 8211 (PAPI) is reachable from untrusted networks. Releases past end of maintenance are presumed affected.

## Fix

Upgrade AOS-8 to 8.13.3.1 (8.13 train) or 8.10.0.24 (8.10 train), or any later release. Fixed versions are as reported by press coverage of HPESBNW05162.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79955
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79955
- 2026-10-25T03:17:38+00:00 analyst — Part of HPE advisory HPESBNW05162 (Oct 22 2026, 72 CVEs). The HPE page is JS-only and returned no text, so nothing is marked verified. Affected ranges come from the CNA record (via SecHOT). Fixed versions and the PAPI port 8211 come from two press write-ups of the advisory. No exploitation or public PoC reported.

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] Critical HPE Aruba AOS-8 Vulnerability (cyberpress) https://cyberpress.org/critical-hpe-aruba-aos-8-vulnerability/
- [describes] HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws https://dailysecurityreview.com/resources/hpe-patches-72-aruba-aos-8-and-aos-10-flaws-eight-at-cvss-10-0/

## From the sources

An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_