HPE ArubaOS 8: Authentication bypass in PAPI protocol

Summary

An authentication bypass in the PAPI protocol of HPE ArubaOS 8 (AOS-8) allows an unauthenticated attacker on an adjacent network to circumvent existing authentication controls. Successful exploitation could grant administrative access, allow changes to system configuration, expose or manipulate sensitive data and disrupt network operations. No credentials or user interaction are required, but the attacker must be on the same network segment as the affected device. The CVSS v3.1 base score of 9.6 (critical) is taken from the CNA record.

Affected

• AOS-8 8.13.0.0 to 8.13.3.0 (per CNA record)
• AOS-8 8.10.0.0 to 8.10.0.23 (per CNA record)
• Treat AOS-8 8.12 and older branches as affected; no fixed release in those branches is confirmed.
• Verify the exact range on the HPE advisory HPESBNW05162 before acting.

Fixed in

• AOS-8 8.13.3.1 or later
• AOS-8 8.10.0.24 or later
• Branches 8.12 and older: no fixed release confirmed; move to a fixed release train.

Workaround

• Keep management interfaces (CLI, web UI) off untrusted networks and restrict them to a dedicated management VLAN or firewall policy, with logging (HPE guidance, as reported).
• Third-party advice, not verified by the vendor: block UDP 8211 (PAPI) at network boundaries from segments that have no need to reach the controllers.
• Workarounds only reduce exposure; patching is the actual fix.

Exploitation

• No confirmed in-the-wild exploitation found.
• Not listed in CISA KEV as of the last check (verify in the catalog).
• No public proof-of-concept found in searches; this does not rule out that one exists.
• Sibling AOS-8 CVEs are listed with exploitation status Unknown.

Our recommendation

• Inventory all AOS-8 Mobility Conductors, Controllers, Gateways and Instant access points, including any on 8.12 or older branches.
• Upgrade to 8.13.3.1 or 8.10.0.24 or later, following HPE's upgrade guidance and confirming the exact build on the HPE portal.
• Until patched, restrict UDP 8211 (PAPI) and management interfaces to controller and AP subnets, and test that the restriction works.
• Review controller logs for unexpected administrator logins or configuration changes.
• Monitor for public proof-of-concept code and KEV listing, and re-check the NVD record once analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• Strix AI: CVE-2026-79870 www.strix.ai
• VulDB: CVE-2026-79870 (conflicting CVSS, not authoritative) vuldb.com
• Cyberpress: Critical HPE Aruba AOS-8 vulnerability cyberpress.org
• Windows Forum: HPE Aruba AOS-8 and AOS-10 security update windowsforum.com
• Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
• CyberExperts: Aruba AOS wireless patches cyberexperts.com
• Brandefense: CVE-2026-79844 (sibling AOS-8 CVEs) brandefense.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:13.