ArubaOS 8: Buffer overflow in PAPI protocol causes denial of service

Summary

A buffer overflow in the PAPI management protocol of ArubaOS 8 affects Aruba Mobility Controllers and related devices. An unauthenticated remote attacker can send crafted traffic to PAPI (UDP port 8211) to disrupt the availability of the service on the controller, with limited impact on integrity. The bulletin treats the issue as a denial-of-service flaw; the CVSS score is 8.2 (High) in the NVD/CNA record, while VulDB lists 6.5.

Affected

• ArubaOS 8.13.0.0 to 8.13.3.0 (per CNA record)
• ArubaOS 8.10.0.0 to 8.10.0.23 (per CNA record)
• Unresolved: the 8.12 branch appears in third-party data but not in the excerpts of the HPE bulletin reviewed. Confirm in the bulletin table.
• Other branches (for example 10.x) are not affected by this CVE according to the records reviewed; confirm in the bulletin.

Fixed in

• ArubaOS 8.13.3.1 (as reported by secondary sources; confirm in the HPE bulletin)
• ArubaOS 8.10.0.24 (as reported by secondary sources; confirm in the HPE bulletin)
• Systems on 8.12.x have no fixed release on that branch according to a secondary source; move to a fixed release train.

Workaround

• No CVE-specific workaround is documented in the sources reviewed.
• Interim measure (recommended): restrict access to PAPI (UDP 8211) to the access point and controller network segments and block it from the internet and guest networks.
• Restrict management interfaces, as HPE advises for this bulletin.

Exploitation

• No known exploitation in the wild according to the vendor.
• Not listed in the CISA KEV catalogue (checked 24 October 2026).
• No public proof-of-concept known.
• A third-party market estimate exists (USD 5,000 to 25,000 for an exploit); this is not evidence of exploitation.

Our recommendation

• Identify all ArubaOS 8 controllers and check their versions against the HPE bulletin HPESBNW05162.
• Patch 8.10.x systems to 8.10.0.24 and 8.13.x systems to 8.13.3.1 as one cycle, since the fixed builds cover the whole bulletin.
• Plan a train upgrade for 8.12.x and older systems.
• Until patched, restrict UDP 8211 and verify with firewall tests that it is not reachable from untrusted networks.
• Monitor controller availability and logs for PAPI-related disruptions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE Security Bulletin HPESBNW05162 support.hpe.com
• VulDB entry 425475 vuldb.com
• Carthage Electronics threat brief (fixed versions) carthageelectronics.com
• Brandefense advisory summary brandefense.io
• Safeguard analysis of the HPE Aruba AOS bulletin safeguard.sh
• Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
• pwn.watch: HPE Aruba AOS critical RCE October 2026 pwn.watch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:10.