HPE Aruba AOS-8: Buffer overflow in PAPI protocol allows authentication bypass
Summary
A buffer overflow in the PAPI protocol of HPE ArubaOS AOS-8 allows an unauthenticated remote attacker to bypass authentication. Successful exploitation could grant administrative access, allow changes to the system configuration, and expose or manipulate sensitive data. Controllers reachable from the internet or from untrusted networks are at the greatest risk; NVD has not yet assessed the CVE, and the CNA rates it CVSS 9.8 (critical).
Affected
- AOS-8 8.13.0.0 to 8.13.3.0
- AOS-8 8.10.0.0 to 8.10.0.23
- AOS-8 8.12 train: reported as affected by secondary sources, not confirmed in the official CVE record; verify against the HPE bulletin
- End-of-maintenance releases should be presumed affected.
Fixed in
- AOS-8 8.13.3.1 or later
- AOS-8 8.10.0.24 or later
- AOS-8 8.12.x: no fixed release; migrate to a fixed train
Workaround
Unknown. No vendor-specific workaround has been confirmed for this CVE. Restrict access to management interfaces until patching is complete.
Exploitation
- Exploited in the wild: no, according to HPE.
- Public proof-of-concept: none known.
- CISA KEV: not listed as of 24 October 2026.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all AOS-8 controllers, gateways and Instant APs with exact build numbers.
- Upgrade to 8.13.3.1 or 8.10.0.24 or later, or migrate off unsupported branches.
- Restrict UDP 8211, the web management interface and SSH to management networks only, and keep controllers off the internet (general hardening, not an HPE-confirmed mitigation).
- Review logs for unexpected admin logins or configuration changes since 22 October 2026.
- Recheck the HPE bulletin and the CISA KEV catalogue, as the status can change quickly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS vulnerabilities ccb.belgium.be
- Strix CVE-2026-79856 www.strix.ai
- Vulners PT-2026-121595 vulners.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- Carthage Electronics CVE threat brief, 24 October 2026 carthageelectronics.com
- The Backroom Tech: HPE patches 72 ArubaOS vulnerabilities thebackroomtech.com
- SecurityOnline: HPE Networking AOS vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:01.
Original description (NVD)
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.