---
id: "CVE-2026-95712"
kind: "vulnerability"
aliases: ["CVE-2026-95712"]
title: "Aruba AOS-8: PAPI protocol flaw leaks information to unauthenticated adjacent attackers"
severity: "high"
cvss: 7.1
epss: 0.00192
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aos-8", "aruba", "infrastructure", "network-appliance"]
not_affected_if: []
published_at: "2026-10-22T19:18:07+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:31:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95712", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-95712", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-8: PAPI protocol flaw leaks information to unauthenticated adjacent attackers

A sensitive information disclosure flaw in the PAPI protocol of Aruba AOS-8 lets an unauthenticated attacker on an adjacent network read limited information the service handles. The same flaw can also disrupt the availability of the affected service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AOS-8 controller version against the advisory's affected list (unknown from these sources)
- Confirm whether PAPI is reachable from networks the attacker could reach (unknown from these sources)

## Fix

- Upgrade AOS-8 to the fixed release named in the vendor advisory (unknown from these sources)

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95712
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-95712

## From the sources

A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_