HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
CVE-2026-79856
Unauthenticated buffer overflow in HPE Aruba AOS-8 PAPI
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A buffer overflow in the PAPI protocol of HPE Aruba AOS-8 lets an unauthenticated remote attacker bypass authentication controls. No user interaction is required. Successful exploitation can yield administrative access, configuration changes, and the ability to read or alter sensitive data. Systems running AOS-8 are affected; HPE has not listed specific builds.
What to do: HPE has not listed a fixed version or workaround. Apply HPE's update for CVE-2026-79856 when it is published.
| Product | Affected |
|---|---|
| HPE Aruba AOS-8 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
- Weakness
- CWE-119
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H