ArubaOS 8: Unauthenticated file write in PAPI protocol

Summary

CVE-2026-79885 is an unauthenticated file write vulnerability in the PAPI protocol of HPE ArubaOS 8 (AOS-8), which HPE uses for access point management. An unauthenticated remote attacker who can reach the affected service can make limited modifications to files on the system and disrupt the availability of the service. Exploitation requires network access to the PAPI service (reported as UDP 8211) and no credentials or user interaction, so the risk is highest for controllers reachable from guest, IoT or other untrusted networks.

Affected

• Per the CNA record (HPE): ArubaOS 8.10.0.0 to 8.10.0.23
• Per the CNA record (HPE): ArubaOS 8.13.0.0 to 8.13.3.0
• Unknown: whether ArubaOS 8.12.x is affected. Third-party sources list 8.12.0.0 to 8.13.3.0, but the CNA record does not list 8.12.x. Check the HPE advisory.

Fixed in

• ArubaOS 8.13.3.1 (secondary sources, verify against the HPE advisory)
• ArubaOS 8.10.0.24 (secondary sources, verify against the HPE advisory)
• Unknown: fixed release for the 8.12.x branch

Workaround

• No workaround confirmed by HPE in the sources reviewed.
• Third-party advice (unverified against HPE): restrict management interfaces to a dedicated management VLAN or behind firewall policy with logging.
• Third-party advice (unverified): block UDP 8211 from network segments that do not need to reach the controllers.

Exploitation

• HPE reports no evidence of exploitation in the wild and no public proof-of-concept code as of the sources reviewed.
• Not listed in CISA's Known Exploited Vulnerabilities catalogue as of 23 to 24 October 2026.
• This status can change quickly after disclosure.

Our recommendation

• Identify all AOS-8 controllers, gateways and mobility conductors and check their exact version.
• Patch affected controllers to 8.13.3.1 or 8.10.0.24 as soon as possible, or apply the complete HPE release for the patch cycle, since HPE lists several related PAPI flaws in the same advisory.
• Confirm the 8.12.x status and fixes in the HPE advisory HPESBNW05162.
• Until patched, block UDP 8211 from guest, IoT and other untrusted segments and restrict management access.
• Monitor logs for unexpected PAPI traffic and unexpected file changes on controllers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• VulDB vulnerability 425493 vuldb.com
• Strix CVE-2026-79885 www.strix.ai
• Cyberexperts: Aruba AOS wireless patches cyberexperts.com
• BleepingComputer: HPE patches eight max-severity AOS flaws www.bleepingcomputer.com
• Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
• Vulners CNNVD-2026-85776613 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:08.