CVE-2026-79885

HighCVSS 8.2/10Last modified Nov 2, 2026

Description

An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Hewlett Packard Enterprise (HPE)ArubaOS (AOS)>= 8.13.0.0, <= 8.13.3.0; >= 8.10.0.0, <= 8.10.0.23

References

Timeline

Published
Oct 22, 2026
Last modified
Nov 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-798868.2An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticateCVE-2026-798878.1A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exCVE-2026-798888.1A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overCVE-2026-798898.1Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overCVE-2026-79894.2Insufficient data validation in DataTransfer in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendeCVE-2026-798908.1There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PCVE-2026-798918.1A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbCVE-2026-798927.8A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful expCVE-2026-798937.5Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. SuccessfulCVE-2026-798947.5An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation of this vulnerabilityCVE-2026-798957.5Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. SuCVE-2026-798967.5Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthe
CVE-2026-79885: High severity, CVSS 8.2 | Vulnix