HPE Aruba AOS-8: Authentication bypass in PAPI protocol
Summary
An authentication bypass in the PAPI protocol of HPE Aruba AOS-8 allows an unauthenticated attacker on an adjacent network segment to circumvent authentication controls. Successful exploitation can grant administrative access, allow changes to system configuration and expose or manipulate sensitive data. The attack requires adjacent network access and no credentials; it is not an internet-facing vulnerability.
Affected
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS-8) 8.13.0.0 to 8.13.3.0
- AOS-8 8.10.0.0 to 8.10.0.23
- Per a third-party listing, AOS-8 8.12.x is also affected (not confirmed by HPE)
Fixed in
- AOS-8 8.13.3.1
- AOS-8 8.10.0.24
- Unknown for 8.12.x: one source states no fixed release exists in this branch; move to 8.13.3.1 or later (not confirmed by HPE)
Workaround
- Restrict CLI and web management to a dedicated management VLAN or firewall policy (HPE workaround as reported by secondary sources)
- Block or restrict UDP 8211 (PAPI) to AP and controller subnets only, and keep it away from guest and IoT VLANs (recommended by third parties, not stated as an HPE workaround)
Exploitation
- HPE states it is not aware of exploit code or attacks.
- CISA SSVC assessment: exploitation none, not automatable.
- No public proof of concept found; this does not prove that none exists.
- Not listed in CISA KEV according to a third-party aggregator; not checked directly.
Our recommendation
- Inventory all AOS-8 controllers and Instant access points and record their exact versions.
- Upgrade to AOS-8 8.13.3.1 or 8.10.0.24 (or later) and plan a move off 8.12.x.
- Until patched, keep management interfaces and UDP 8211 off guest, IoT and user networks.
- Apply the upgrade for the whole HPE advisory, which bundles many other critical flaws.
- Verify the CVE ID mapping (one source lists this description under CVE-2026-79870) and the exact scope in the signed HPE advisory before final sign-off.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- Vulners PT-2026-121614 vulners.com
- VulDB CVE-2026-79875 vuldb.com
- CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
- Cyberexperts: Aruba AOS wireless patches cyberexperts.com
- Rescana: HPE Aruba AOS critical October 2026 www.rescana.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:53.
Original description (NVD)
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.