---
id: CVE-2026-79856
title: >-
  Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass
  in AOS-8
summary: >-
  A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that
  could allow an unauthenticated remote attacker to circumvent existing
  authentication controls. Successful exploitation could allow an attacker to
  gain administrati…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-23T19:34:20.749716Z'
published: '2026-10-22'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T03:55:57.628Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79856'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00611
epssPercentile: 0.49014
ingestedAt: '2026-10-22T22:00:50.377Z'
---

## Overview

A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

## Affected

- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.