ArubaOS 10: Authentication bypass in PAPI protocol

Summary

Authentication bypass vulnerabilities in the PAPI management protocol of ArubaOS 10 (AOS-10) allow an unauthenticated attacker on an adjacent network to bypass existing authentication controls. Successful exploitation can grant administrative access, allow changes to system configurations, and expose or manipulate sensitive data on affected devices. The CVSS vector in the CVE data is AV:A (adjacent network), but some sources list AV:N, so exposure of UDP port 8211 must be verified. The CVE ID differs between the NVD record and HPE's bulletin, so the mapping should be confirmed.

Affected

• ArubaOS 10.8: 10.8.0.0 to 10.8.1.1
• ArubaOS 10.7: 10.7.0.0 to 10.7.2.6
• ArubaOS 10.4: 10.4.0.0 to 10.4.1.13
• The lower bounds differ between sources; check the HPE advisory version table.
• AOS-8 is not affected by this PAPI issue according to the sources.

Fixed in

• AOS-10 10.8.1.2
• AOS-10 10.7.2.7
• AOS-10 10.4.1.14
• The AOS-8 fixes (8.13.3.1 and 8.10.0.24) do not apply to this issue.

Workaround

• Place CLI and web management interfaces on a dedicated layer 2 segment or VLAN, and/or restrict them with layer 3+ firewall policies (HPE interim guidance as reported).
• Block UDP port 8211 (PAPI) from network segments that have no need to reach the controllers.
• A configuration option does not replace the patch; only the fixed builds remove the vulnerability.

Exploitation

HPE reportedly found no evidence of active in-the-wild exploitation and was not aware of public exploit code as of the advisory date. No CISA KEV listing was confirmed in the available sources. No public proof of concept was found, which does not mean none exists.

Our recommendation

• Inventory all Aruba controllers and access points running AOS-10 and compare their versions with the fixed builds.
• Update affected devices to AOS-10 10.8.1.2, 10.7.2.7, 10.4.1.14 or later.
• Until patching is complete, restrict UDP 8211 and the management interfaces to required networks only, and make sure they are not reachable from the internet.
• Confirm the CVE ID and version ranges against HPE bulletin HPESBNW05162 and NVD.
• Monitor for KEV listings or public exploits, as the advisory is recent.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• BleepingComputer: HPE patches eight max-severity flaws in AOS www.bleepingcomputer.com
• Cyberexperts: Aruba AOS wireless patches cyberexperts.com
• The Layman's Security: HPE Aruba AOS critical flaws thelaymansecurity.com
• VulDB entry 425538 vuldb.com
• OffSeq Radar: CVE-2026-79873 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:52.