CVE-2026-79878High· 8.8▾ TwilightA command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI U…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
0.2% → 0.8%
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
arubaos_aos >= 8.13.0.0 <= 8.13.3.0arubaos_aos >= 8.10.0.0 <= 8.10.0.23Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-79850Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-8
CVE-2026-79851Critical· 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
CVE-2026-79849Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
CVE-2026-79844Critical· 10.0Authentication Bypass Leading to Remote Code Execution in AOS-10
CVE-2026-79847Critical· 10.0Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
CVE-2026-79848Critical· 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8