---
id: CVE-2026-79875
title: >-
  Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized
  Administrative Access
summary: >-
  A vulnerability has been identified in the PAPI protocol of AOS-8 that could
  potentially allow an unauthenticated adjacent attacker to circumvent existing
  authentication controls. Successful exploitation could allow an attacker to
  gain a…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T19:13:23.227Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79875'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.0023
epssPercentile: 0.13726
ingestedAt: '2026-10-22T22:00:50.382Z'
---

## Overview

A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

## Affected

- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.