{"id":"CVE-2026-95707","kind":"vulnerability","aliases":["CVE-2026-95707"],"related":[],"title":"Aruba AOS-8: PAPI buffer overflow lets high-privilege remote user run code","description":"A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.","summary":"A buffer overflow in the PAPI protocol of Aruba AOS-8 controllers lets an authenticated remote attacker with high privileges trigger the overflow. Successful exploitation lets the attacker run arbitrary code as a privileged user on the underlying operating system.","severity":"high","cvss":7.2,"epss":0.00367,"exploited":false,"exploited_at":null,"products":[{"name":"ArubaOS (AOS-8)","fixed":[],"affected":">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23","ecosystem":"vendor"}],"ecosystems":[],"tags":["aos-8","aruba","hpe","infrastructure","network-appliance","papi"],"not_affected_if":["aos-10-only","auth-required","management-restricted","no-admin-access","no-aos-8"],"how_to_check":"On each Mobility Conductor and Controller run 'show version'. Affected if it reports 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. The attacker needs high-privilege (admin) credentials and network reach to PAPI (UDP 8211 per sibling records), so also check who can reach it and who holds admin accounts.","fix":"Upgrade to a release above the affected range, as listed in HPE bulletin HPESBNW05162. Press coverage of the sibling CVEs names 8.13.3.1 and 8.10.0.24, but the HPE text was not readable, so this is unconfirmed. Until patched, restrict CLI, web and PAPI access to a dedicated L2 segment/VLAN or L3+ firewall policy, as HPE recommends.","status":"open","published_at":"2026-10-22T19:18:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:27:48+00:00","updated_at":"2026-10-25T03:29:12+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-10-25T03:27:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Aruba AOS-8: PAPI buffer overflow lets high-privilege remote user run code","impact":"high","summary":"A buffer overflow in the PAPI protocol of Aruba AOS-8 controllers lets an authenticated remote attacker with high privileges trigger the overflow. Successful exploitation lets the attacker run arbitrary code as a privileged user on the underlying operating system.","category":"infrastructure","nicknames":[],"who_cares":["aos-8","aruba","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs code as a privileged user on the controller OS","analyst_note":"Find the HPE Aruba security advisory for CVE-2026-95707 to get affected and fixed AOS-8 versions and any workaround; the NVD entry alone does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-aos-8","auth-required"],"who_is_affected":"AOS-8 controllers and gateways with PAPI reachable from the network. Operators who run only AOS-10 or have no AOS-8 gear can skip it. The sources do not list affected or fixed AOS-8 versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00057,"input_tokens":3357,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the HPE Aruba security advisory for CVE-2026-95707 to get affected and fixed AOS-8 versions and any workaround; the NVD entry alone does not list them.","search":"'-2026':16A,19A '-8':3A,23A,25B,43B,83C '-95707':17A,20A 'achiev':94C 'allow':85C,101C 'ao':2A,24B,42B,82C 'aos':22A 'applianc':31B 'arbitrari':62B,106C 'aruba':1A,26B,41B 'arubaos':21A 'attack':49B,60B,89C,103C 'authent':47B,87C 'buffer':5A,34B,74C 'code':14A,63B,96C,107C 'control':44B 'could':84C,100C 'cve':15A,18A 'execut':97C,105C 'exploit':57B,99C 'high':9A,51B,91C 'high-privileg':8A 'hpe':27B 'infrastructur':28B 'let':7A,45B,58B 'network':30B 'network-appli':29B 'oper':71B,115C 'overflow':6A,35B,55B,75C 'papi':4A,32B,38B,79C 'privileg':10A,52B,66B,92C,110C 'protocol':39B,80C 'remot':11A,48B,88C,95C 'run':13A,61B 'success':56B,98C 'system':72B,116C 'trigger':53B 'under':70B,114C 'user':12A,67B,111C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"AOS-8 Mobility Conductors and Controllers on 8.10.0.0 to 8.10.0.23 or 8.13.0.0 to 8.13.3.0. Exploitation needs an authenticated, high-privilege remote attacker, so the risk is mainly stolen or shared admin credentials and management interfaces exposed to untrusted networks. AOS-10-only deployments and networks with management and PAPI properly segmented are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95707","severity":null,"published_at":"2026-10-22T19:18:06+00:00","modified_at":"2026-10-23T20:17:29+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-95707","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95707","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95707:727","url":null,"severity":null,"published_at":"2026-10-25T03:29:12+00:00","modified_at":"2026-10-25T03:29:12+00:00","first_seen_at":"2026-10-25T03:29:12+00:00","fetched_at":"2026-10-25T03:29:12+00:00","note":"Part of HPE bulletin HPESBNW05162 (2026-10-22). HPE page is JS-only and unreadable, so nothing is marked verified. Affected ranges come from the CNA record via SecHOT. No fixed version is stated for this CVE in any source I could read. The sibling run's 8.13.3.1 / 8.10.0.24 comes from press coverage, so I treat it as unconfirmed. Mitigation is HPE's text as quoted by BleepingComputer. No exploitation or PoC (HPE, CISA SSVC none)."}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3189,"url":"https://www.sechot.net/cve/CVE-2026-95707","title":"SecHOT: CVE-2026-95707","kind":"other","source":"analyst","text":"Mirrors CNA (HPE) record: CVSS 3.1 7.2 AV:N/AC:L/PR:H. Affected >=8.10.0.0 <=8.10.0.23 and >=8.13.0.0 <=8.13.3.0. Fixed versions not stated. CISA SSVC exploitation none. No known PoC.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}