Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-79866: ArubaOS 8 lets attacker read, change or delete files
CVE-2026-79866 · published 2 days ago
Summary
The ArubaOS 8 operating system can be accessed without a login to trick it into exposing any file on the server. An attacker could read, alter or erase those files, potentially taking control of the underlying system. Apply the vendor's latest security update or follow their recommended mitigation steps as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hewlett packard enterprise (hpe) | unknown product | <= 8.13.3.0 |
| hewlett packard enterprise (hpe) | arubaos (aos) | <= 8.13.3.0 |
Original advisory text
Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published22 Oct 2026
Updated24 Oct 2026
First seen22 Oct 2026
Track software like this
Free during beta