Live › vulnerability › CVE-2026-95707
Go to dashboardA buffer overflow in the PAPI protocol of Aruba AOS-8 controllers lets an authenticated remote attacker with high privileges trigger the overflow. Successful exploitation lets the attacker run arbitrary code as a privileged user on the underlying operating system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
AOS-8 Mobility Conductors and Controllers on 8.10.0.0 to 8.10.0.23 or 8.13.0.0 to 8.13.3.0. Exploitation needs an authenticated, high-privilege remote attacker, so the risk is mainly stolen or shared admin credentials and management interfaces exposed to untrusted networks. AOS-10-only deployments and networks with management and PAPI properly segmented are at much lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ArubaOS (AOS-8) | vendor | >= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 | – |
show version8.13.3.0, or 8.10.x at or below 8.10.0.238.13.3.1 and 8.10.0.24, but the HPE text was not readable, so this is unconfirmedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-95707")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.