Zero Radar
← feed
CriticalVulnerabilityCVE-2026-79856updated 25 Oct 2026, 16:50 UTC

Aruba AOS-8 PAPI protocol flaw lets attackers bypass login

A weakness in how AOS-8 network devices handle a management protocol could let someone outside your network take over the device without a password. Attackers could then change settings or read sensitive data.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login credentials needed
  2. 2PAPI protocolMalformed input overflows a memory buffer
  3. 3Authentication bypassedLogin checks are circumvented
  4. 4Admin access gainedAttacker controls the device
  5. ResultAttacker controls the AOS-8 device

What happened

A buffer overflow in the PAPI protocol of Aruba AOS-8 allows unauthenticated remote attackers to circumvent authentication controls.

Why it is dangerous: A successful attack could give full administrative access to the device, allowing configuration changes and access to sensitive data. Organizations running exposed AOS-8 controllers or gateways are at risk.

Are you affected?

You are affected if you run AOS-8 network controllers or gateways with the PAPI protocol reachable over the network.

AOS-8 (affected versions not specified in the provided material)

What to do

  1. Check the vendor advisory for the AOS-8 version that fixes this issue and plan an update
  2. Restrict network access to AOS-8 management interfaces and PAPI to trusted hosts only
  3. Monitor device logs for unexpected administrative logins or configuration changes

Timeline

  1. 22 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:50 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-79856 · GHSA-5x4g-4q46-f9mw
CVSS
9.8 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 19:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Aruba AOS-8 PAPI protocol flaw lets attackers bypass login · Zero Radar