HPE ArubaOS (AOS-8): Unauthenticated SQL injection in PAPI protocol

Summary

An unauthenticated SQL injection vulnerability in the PAPI protocol of AOS-8 allows a remote attacker to read and modify sensitive data in the underlying database and to interrupt the service. PAPI is Aruba's access point management protocol and runs on UDP port 8211. No login is required, so exposure of this port to untrusted networks is the main risk factor. CVSS 9.8 (Critical) is taken from the CNA record; NVD analysis was still pending at the time of research.

Affected

• AOS-8.13.0.0 to 8.13.3.0
• AOS-8.10.0.0 to 8.10.0.23
• AOS-8.12: conflicting information in sources; treat as affected until HPE's CSAF file confirms otherwise
• AOS-10 is not affected by this CVE

Fixed in

• AOS-8.13.x: 8.13.3.1 and later (secondary source, not yet verified against the advisory table)
• AOS-8.10.x: 8.10.0.24 and later (secondary source, not yet verified against the advisory table)
• AOS-8.12: no fix of its own; move to a fixed train (8.13.3.1 or later)

Workaround

• No CVE-specific vendor workaround confirmed. HPE's general guidance is to install fixed releases and restrict access to management interfaces.
• Interim measure (not a documented HPE workaround): block UDP 8211 from untrusted networks and keep management interfaces on a dedicated segment until patched.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• HPE is not aware of exploit code or attacks.
• Not listed in the CISA KEV catalogue.
• No public proof of concept found in the sources reviewed (as of 22 to 26 October 2026).

Our recommendation

• Inventory all AOS-8 Mobility Conductors, Controllers, Gateways and Instant APs, including any on 8.12.
• Upgrade to 8.13.3.1 or 8.10.0.24 (or later), or move 8.12 devices to 8.13.
• Restrict UDP 8211 and management interfaces to trusted networks now and verify that none are reachable from the internet.
• Patch the whole HPE bulletin HPESBNW05162, as it contains several higher-rated AOS-8 flaws.
• Verify the exact affected ranges in HPE's CSAF file before closing the ticket.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
• CyberExperts: Aruba AOS wireless patches cyberexperts.com
• Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
• Brandefense: CVE-2026-79844 (bundle context) brandefense.io
• Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
• GBHackers: Critical HPE Aruba AOS-8 flaw gbhackers.com
• Strix AI: CVE-2026-79858 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:54.