HPE's disclosure of CVE-2026-79857 describes an unauthenticated command-injection path in the AOS-8 PAPI service. The flaw matters because the management plane controls how access points receive configuration and how wireless infrastructure behaves. A vulnerable controller can therefore carry risk for an entire campus or branch, even when its web interface appears hidden.
Vulnerability overview
The HPE advisory HPESBNW05162 rates CVE-2026-79857 at 9.8 on the CVSS 3.1 scale. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the weakness is CWE-77 command injection. No privileges or user interaction are required.
The CVE record states that crafted packets sent to the affected UDP port can lead to remote code execution as a privileged user. CISA's enrichment records exploitation as none, automatable as yes and technical impact as total. HPE reported no known public exploit code when the advisory was published.
Mechanism and exploitation conditions
PAPI is used for access point management. Aruba's technical documentation places PAPI on UDP 8211 and describes its role in configuration and controller communication. The vendor says the AOS-8 implementation can be reached by crafted packets, but does not publish the vulnerable parser or a packet example.
The management-plane concern follows from the service location. Access points must reach controllers, and controllers may reach other controllers or management systems. Firewalls often permit those flows because the wireless estate needs them. An attacker who reaches the same network path can interact with the exposed service without a login.
The exact code path remains unknown publicly. Defenders should therefore avoid assuming that the web management interface is the only relevant entry point and should inspect PAPI flows directly.
Impact
Privileged command execution on the underlying operating system can affect data, configuration and availability. At a wireless controller or gateway, those changes can influence authentication, access point control and network policy. The central role of the appliance increases the recovery burden if an attacker establishes persistence or changes identity material.
The CVSS values are high for all three impact categories. The score does not prove that an attacker has used the flaw. It describes the potential consequences that justify a priority response.
Affected products and scope
HPE identifies AOS-8.13.0.0 through 8.13.3.0 and AOS-8.10.0.0 through 8.10.0.23 as affected. The listed products include Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-8 Instant access points and AOS-8 access points.
Teams should include the full PAPI relationship in scope. A controller with a fixed build can still be surrounded by vulnerable access points or obsolete management paths. A supported branch should be confirmed through the vendor and the running image rather than by device age alone.
Exposure context
ZoomEye Search for app="ArubaOS" returned 212 product-fingerprint matches. The CVE Filter vul.cve="CVE-2026-79857" returned 0. Exposure is 212, with the result representing product fingerprints rather than confirmed vulnerable assets.
Search: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcnViYU9TIg%3D%3D
Remediation and mitigations
Upgrade AOS-8.13 systems to 8.13.3.1 or later and AOS-8.10 systems to 8.10.0.24 or later. Verify the build on each device and preserve the output as evidence.
Restrict management services with the vendor's guidance: a dedicated layer 2 segment or VLAN and firewall policy at layer 3 and above. Apply equivalent discipline to PAPI. Permit UDP 8211 only for documented controller and access point relationships, and add accounting and logging.
Review audit records from the exposure window for unexpected PAPI senders, configuration changes and service disruptions. The patch closes the known defect; the review determines whether the management plane needs additional incident handling.