HPE ArubaOS AOS-8: Unauthenticated command injection via PAPI protocol
Summary
A command injection flaw in the AOS-8 command line interface, reached through the PAPI protocol on UDP port 8211, affects HPE ArubaOS 8 wireless controllers and related infrastructure. An unauthenticated attacker on an adjacent network can send crafted PAPI packets and execute arbitrary code as a privileged user on the underlying operating system. The CVSS base score is 8.8 (High), and CISA SSVC rates the technical impact as total.
Affected
- ArubaOS 8.13.0.0 to 8.13.3.0 (per the CVE record and secondary sources; verify against the HPE advisory table)
- ArubaOS 8.10.0.0 to 8.10.0.23 (default: affected)
- The 8.11 branch is not listed in the sources reviewed; do not assume it is unaffected.
- Version ranges conflict between sources; the HPE advisory is authoritative.
Fixed in
- Candidate fixes (unverified, to be confirmed in the HPE advisory): ArubaOS 8.13.3.1 and 8.10.0.24
- Unknown whether the advisory maps these releases to this CVE specifically.
Workaround
- No CVE-specific workaround confirmed by HPE.
- Place management interfaces on a dedicated VLAN or layer 2 segment, or restrict access with firewall rules.
- Block UDP port 8211 from segments that do not need to reach the controllers.
- These measures reduce exposure but do not remove the vulnerability.
Exploitation
- No active exploitation known at disclosure.
- No public exploit code known; VulDB reports no exploit available.
- Not listed in CISA KEV according to one aggregator; verify directly in the KEV catalogue.
- PAPI has been a recurring target of command injection flaws.
Our recommendation
- Identify all AOS-8 controllers and access points in use and check their versions against the HPE advisory HPESBNW05162.
- Patch to a release that addresses the full bulletin, not only this CVE, once the fixed versions are confirmed.
- Until patched, restrict UDP 8211 and management access to necessary segments only.
- Monitor for unexpected PAPI traffic and changes on controllers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- VulDB CVE-2026-79878 vuldb.com
- Offseq threat entry CVE-2026-79878 radar.offseq.com
- Strix CVE-2026-79878 www.strix.ai
- CCB Belgium advisory on HPE Aruba AOS ccb.belgium.be
- CyberExperts AOS wireless patches cyberexperts.com
- NHS Digital cyber alert CC-4571 (earlier PAPI flaw) digital.nhs.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:53.
Original description (NVD)
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.