---
id: "CVE-2026-95707"
kind: "vulnerability"
aliases: ["CVE-2026-95707"]
title: "Aruba AOS-8: PAPI buffer overflow lets high-privilege remote user run code"
severity: "high"
cvss: 7.2
epss: 0.00367
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "ArubaOS (AOS-8)", "fixed": [], "affected": ">= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23", "ecosystem": "vendor"}]
ecosystems: []
tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "papi"]
not_affected_if: ["aos-10-only", "auth-required", "management-restricted", "no-admin-access", "no-aos-8"]
published_at: "2026-10-22T19:18:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95707", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95707", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:29:12+00:00"}]
---

# Aruba AOS-8: PAPI buffer overflow lets high-privilege remote user run code

A buffer overflow in the PAPI protocol of Aruba AOS-8 controllers lets an authenticated remote attacker with high privileges trigger the overflow. Successful exploitation lets the attacker run arbitrary code as a privileged user on the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ArubaOS (AOS-8) affected >= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23 fixed ?

## How to check

On each Mobility Conductor and Controller run 'show version'. Affected if it reports 8.13.x at or below 8.13.3.0, or 8.10.x at or below 8.10.0.23. The attacker needs high-privilege (admin) credentials and network reach to PAPI (UDP 8211 per sibling records), so also check who can reach it and who holds admin accounts.

## Fix

Upgrade to a release above the affected range, as listed in HPE bulletin HPESBNW05162. Press coverage of the sibling CVEs names 8.13.3.1 and 8.10.0.24, but the HPE text was not readable, so this is unconfirmed. Until patched, restrict CLI, web and PAPI access to a dedicated L2 segment/VLAN or L3+ firewall policy, as HPE recommends.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95707
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95707
- 2026-10-25T03:29:12+00:00 analyst — Part of HPE bulletin HPESBNW05162 (2026-10-22). HPE page is JS-only and unreadable, so nothing is marked verified. Affected ranges come from the CNA record via SecHOT. No fixed version is stated for this CVE in any source I could read. The sibling run's 8.13.3.1 / 8.10.0.24 comes from press coverage, so I treat it as unconfirmed. Mitigation is HPE's text as quoted by BleepingComputer. No exploitation or PoC (HPE, CISA SSVC none).

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] SecHOT: CVE-2026-95707 https://www.sechot.net/cve/CVE-2026-95707
- [mitigation] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_