HPE ArubaOS AOS-10: Unauthenticated command injection in PAPI protocol

Summary

A command injection flaw in the PAPI management protocol of HPE Aruba AOS-10 allows an unauthenticated remote attacker to run arbitrary code with privileged rights on the underlying operating system. The attacker only needs network access to the PAPI service (UDP 8211) on an affected access point, gateway or controller, and no credentials. The CVSS score is 9.8 (critical). The bulletin covers 72 CVEs in total, so the patch should cover the whole advisory.

Affected

• AOS-10.8.x up to and including 10.8.1.1 (per HPE advisory excerpt; some sources list from 10.8.0.0)
• AOS-10.7.x up to and including 10.7.2.6
• AOS-10.4.x up to and including 10.4.1.13 (per NVD record; not confirmed in the HPE excerpt)
• Sources conflict on the 10.3 and 10.6 branches; verify in the full HPE advisory.

Fixed in

• AOS-10.8.x: 10.8.1.2 or later
• AOS-10.7.x: 10.7.2.7 or later
• AOS-10.4.x: 10.4.1.14 or later
• AOS-10.6 branch: Unknown. No fixed build found in the sources.
• End-of-support branches: HPE lists no fixes for some of them. Unknown for these releases.

Workaround

• Block UDP 8211 (PAPI) from untrusted networks, guest networks, IoT networks and the internet.
• Restrict management access to a dedicated admin VLAN.
• CPsec (IPsec tunnel for PAPI) does not fix this vulnerability; only the fixed builds do.

Exploitation

No known public exploit code or in-the-wild exploitation at time of writing (30 Oct 2026). No CISA KEV entry found. Status should be rechecked, as the flaw is an unauthenticated RCE.

Our recommendation

• Inventory all AOS-10 devices and their versions, including end-of-support devices.
• Upgrade affected devices to the fixed builds listed above as a priority, and apply the rest of the bulletin.
• Until patched, block UDP 8211 from untrusted networks and limit management access.
• Check whether PAPI or the management interface is reachable from the internet (external scan, firewall rules).
• Monitor devices for unusual processes, configuration changes and outbound connections.
• Replace end-of-support devices that receive no fixes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• Belgian CCB advisory ccb.belgium.be
• PT database record PT-2026-121600 vulners.com
• SecurityOnline summary of HPE Networking AOS vulnerabilities securityonline.info
• Rescana analysis of HPE Aruba AOS vulnerabilities www.rescana.com
• Safeguard.sh analysis of AOS 8 and AOS 10 vulnerabilities safeguard.sh
• Back Room Tech summary of ArubaOS vulnerabilities thebackroomtech.com
• pwn.watch summary of HPE Aruba AOS RCE pwn.watch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:56.