CVE-2026-79875: A Verification Checklist for AOS-8 Asset Owners
CVE-2026-79875: A Verification Checklist for AOS-8 Asset Owners CVE-2026-79875 is a critical authentication bypass in the PAPI protocol of HPE Networking ArubaOS AOS-8. The published attack condition is an unauthentica
CVE-2026-79875: A Verification Checklist for AOS-8 Asset Owners
CVE-2026-79875 is a critical authentication bypass in the PAPI protocol of HPE Networking ArubaOS AOS-8. The published attack condition is an unauthenticated adjacent attacker. Successful exploitation could provide administrative access, allow configuration changes, and expose or modify sensitive data.
The advisory gives asset owners enough information to begin a focused review. The affected AOS-8 ranges are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23. Fixed releases are 8.13.3.1 and 8.10.0.24. The CVE record assigns a CVSS 3.1 score of 9.3 and classifies the weakness as CWE-287, Improper Authentication.
1. Prove the running version
Capture the full software version from each controller, gateway, and access point. Record the device identifier and the source of the evidence. Compare the result with both affected ranges and the relevant fixed release. A branch name without a build number is not enough for a defensible inventory.
If a management system and the device disagree, treat the discrepancy as an open item. The device's running state should carry more weight than an intended configuration, but both records are useful for understanding why the inventory drifted.
2. Map the PAPI path
Identify the interfaces and network segments that can reach the PAPI management surface. Check VLANs, routing, firewall rules, wireless bridges, VPNs, and support paths. Confirm whether guest users, laboratory systems, partners, or neighboring hosts can become adjacent to that surface.
The exact vulnerable PAPI message is not public. The mapping exercise is therefore about reducing reachable attack surface, not about proving a specific packet can exploit the device. HPE recommends restricting management interfaces to a dedicated layer-two segment or VLAN and applying layer-three firewall policy and accounting controls.
3. Compare internal and external inventory
On 12 November 2026, ZoomEye returned 212 product-fingerprint matches for app="ArubaOS" and zero for vul.cve="CVE-2026-79875". The Search count is the selected Exposure, but it describes product matches rather than confirmed vulnerable devices.
Use the external list to test the inventory. Does each match have an owner and a device record? If not, investigate the ownership and visibility gap. If it is an internal asset, verify the build and management exposure. The CVE Filter result should not be used as a clean bill of health.
4. Check remediation and exceptions
Apply the fixed release for the deployed AOS-8 branch and verify the software after the change. If a device cannot be patched, record the reason, the compensating network control, the monitoring method, the accountable owner, and the next review date. HPE says end-of-maintenance products should be presumed affected unless stated otherwise, which makes an unexplained unsupported device a governance issue.
Review the entire HPESBNW05162 advisory rather than stopping at this CVE. The same bulletin contains many other AOS-8 and AOS-10 vulnerabilities. A device can move out of the CVE-2026-79875 range and remain exposed to another listed issue.
5. Look for evidence of unauthorized access
Review authentication, command, configuration, and management audit records for unexpected administrative access. Preserve logs before a reboot or rebuild if suspicious activity is present. The public advisory does not provide a unique exploitation signature, so the review should focus on unauthorized administrative outcomes and unexplained changes.
HPE reported no known public discussion or exploit code at release. Current evidence of exploitation is therefore limited, but the consequence of a successful bypass is not. The completion check is a verified fixed build or an approved interim control, a reconciled asset list, and an owner who can explain the management path.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.