HPE warns of critical ArubaOS AOS-8 flaw CVE-2026-79860 enabling remote code execution
HPE Networking published advisory HPESBNW05162 on 22 October 2026 describing CVE-2026-79860, a buffer overflow in specific ArubaOS AOS-8 releases. The flaw can be triggered by crafted PAPI packets sent to UDP port 8211 without authentication, and HPE rates it 9.8 on the CVSS 3.1 scale. Successful exploitation can run arbitrary code with privileged access on the underlying system. Affected releases include AOS-8.13.0.0 through 8.13.3.0 and AOS-8.10.0.0 through 8.10.0.23, with fixes in 8.13.3.1 and 8.10.0.24 or later. The public record does not establish any active exploitation campaign, and HPE recommends restricting management interfaces and verifying patch deployment.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in