CVE-2026-79870

CriticalCVSS 9.6/10Last modified Nov 2, 2026

Description

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	ArubaOS (AOS)	>= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US

Timeline

Published: Oct 22, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-798719.6A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to a CVE-2026-798729.4A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by CVE-2026-798739.3Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing CVE-2026-798749.3An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Su CVE-2026-798759.3A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circu CVE-2026-798769.3A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to CVE-2026-798778.8A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execu CVE-2026-798788.8A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote cod CVE-2026-798798.8Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent att CVE-2026-79888.8Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-798808.7A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server CVE-2026-798818.3An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumv