---
id: CVE-2026-79860
title: >-
  Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution
  in AOS-8
summary: >-
  Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that
  could lead to unauthenticated remote code execution by sending specially
  crafted packets destined to the PAPI (Aruba's access point management
  protocol) UDP por…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T19:13:02.474Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79860'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00358
epssPercentile: 0.28342
ingestedAt: '2026-10-22T22:00:50.378Z'
---

## Overview

Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

## Affected

- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.