ArubaOS (AOS-8): Unauthenticated command injection in PAPI protocol
Summary
ArubaOS 8 wireless controllers and related devices contain a command injection flaw in the PAPI access point management protocol, which listens on UDP port 8211. An unauthenticated remote attacker can send specially crafted packets to this port and execute arbitrary code as a privileged user on the underlying operating system. No credentials are required; the risk depends on whether UDP 8211 is reachable from untrusted networks.
Affected
- AOS-8 8.13.0.0 to 8.13.3.0 (the lower bound is disputed between sources; 8.12.0.0 is also possible)
- AOS-8 8.10.0.0 to 8.10.0.23
- Older branches are presumed affected and are not covered by the bulletin
Fixed in
- AOS-8 8.13.3.1 or later
- AOS-8 8.10.0.24 or later
- AOS-8 8.12.x: no fixed release; move to a fixed branch
Workaround
- Patching is the only complete fix; CPsec limits access to PAPI but does not fix the flaw
- Blocking inbound UDP 8211 at edge firewalls and routers is recommended by a secondary source; not verified in the HPE bulletin
- Workaround details in the HPE bulletin: Unknown.
Exploitation
- HPE knows of no exploitation; CISA SSVC: exploitation none, automatable yes, technical impact total
- Not in the CISA KEV catalogue as checked on 23 to 24 October 2026
- No public proof-of-concept found; the status may change quickly
Our recommendation
- Patch to AOS-8 8.13.3.1 or 8.10.0.24 (or a supported later branch) with high priority
- Move devices on 8.12.x to a fixed branch
- Restrict UDP 8211 to the AP-controller LAN segments now; never expose PAPI to the internet
- Identify legacy controllers on older branches and treat them as unpatched
- Monitor for unusual traffic to UDP 8211 and recheck the HPE bulletin regularly
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE advisory HPESBNW05162 support.hpe.com
- CERT.be advisory on HPE Networking AOS ccb.belgium.be
- VulDB CVE-2026-79857 vuldb.com
- SecurityOnline: HPE Networking AOS vulnerabilities securityonline.info
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
- Safeguard.sh: HPE Aruba AOS 8 and AOS 10 vulnerabilities safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:01.
Original description (NVD)
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.