Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-79861: ArubaOS 10 lets attackers run code via PAPI packets
CVE-2026-79861 · published 2 days ago
Summary
The ArubaOS 10 operating system can be tricked into running any command without needing a login, simply by sending specially crafted PAPI network packets. This could let an attacker take control of the device and the broader network. Apply the latest security updates from HPE and limit PAPI traffic to trusted sources.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hewlett packard enterprise (hpe) | unknown product | <= 10.8.1.1 |
| hewlett packard enterprise (hpe) | arubaos (aos) | <= 10.8.1.1 |
Original advisory text
Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published22 Oct 2026
Updated25 Oct 2026
First seen22 Oct 2026
Track software like this
Free during beta