HPE ArubaOS: Unauthenticated buffer overflow in PAPI service allows code execution
Summary
A buffer overflow in an underlying service of ArubaOS 8 can be triggered by specially crafted packets sent to UDP port 8211, the port of Aruba's PAPI access point management protocol. No authentication is required. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system. The CVSS v3.1 base score is 9.8 (Critical).
Affected
- ArubaOS 8.13.0.0 to 8.13.3.0 - ArubaOS 8.10.0.0 to 8.10.0.23 - ArubaOS 8.12: status unclear, verify in the HPE advisory. Affected products include Mobility Conductors, Mobility Controllers and AOS-8 Instant Access Points.
Fixed in
- ArubaOS 8.13.3.1 and above - ArubaOS 8.10.0.24 and above - Fixed releases are listed in HPE advisory HPESBNW05162. Whether this CVE has its own separate fix is unverified.
Workaround
Unknown. No CVE-specific workaround was found in the advisory text reviewed. - Restrict UDP 8211 to the required AP subnets and peer controllers only - Keep management and PAPI off guest, IoT and internet-facing networks - Block UDP 8211 from untrusted networks
Exploitation
Unknown. No confirmed in-the-wild exploitation was found in the sources reviewed.
Our recommendation
- Identify all affected Mobility Conductors, Mobility Controllers and AOS-8 Instant Access Points and check whether UDP 8211 is reachable from untrusted networks - Upgrade to ArubaOS 8.13.3.1 or later, or 8.10.0.24 or later - Confirm the status of ArubaOS 8.12 in the HPE advisory - Restrict or block UDP 8211 until patching is complete - Monitor for unusual traffic on UDP 8211
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
- Carthage Electronics CVE threat brief, 24 Oct 2026 carthageelectronics.com
- Safeguard.sh analysis of HPE Aruba AOS-8 and AOS-10 CVEs safeguard.sh
- Cybaverse threat brief on HPE Aruba AOS critical flaws www.cybaverse.co.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:55.
Original description (NVD)
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.