Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8

Assurance reviews need answers that can be tested. CVE-2026-79860 affects specific ArubaOS AOS-8 releases and can be reached through PAPI UDP port 8211. HPE rates the buffer overflow at CVSS 3.1 9.8 and says exploitation can execute code as a privileged user.

Those facts lead to five practical questions. They separate confirmed vendor information from assumptions about a particular environment.

Vulnerability overview

HPE Networking published CVE-2026-79860 in HPESBNW05162 on 22 October 2026. The CVE record assigns CWE-120 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

HPE describes crafted PAPI packets sent to UDP port 8211 as the trigger for the overflow. Successful exploitation can run arbitrary code with privileged access on the underlying system.

Mechanism and exploitation conditions

The first technical question is whether the affected service is reachable. Authentication is not required, but network access and the ability to send crafted packets are necessary. The public advisory does not provide the packet structure.

The second question is whether the exact release is affected. AOS-8.13.0.0 through 8.13.3.0 and AOS-8.10.0.0 through 8.10.0.23 are in scope. Fixed releases are 8.13.3.1 and later and 8.10.0.24 and later.

Impact

The CVSS vector rates confidentiality, integrity, and availability impact as high. Privileged code execution can affect device configuration, service state, and the broader wireless environment.

The public record does not establish an active exploitation campaign. The assurance review should therefore describe the potential business effect without converting a maximum impact rating into an incident finding.

Affected products and scope

The advisory covers Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, and AOS-8 Instant Access Points. End-of-maintenance products are presumed affected unless HPE explicitly excludes them.

Inventory precision matters. The review should show which devices run AOS-8, which branch and build they use, and whether each is supported. A generic "Aruba" asset label is not enough.

Exposure context

ZoomEye's app="ArubaOS" search returned 211 product matches during this review. The vul.cve="CVE-2026-79860" filter returned 0.

The product count is not an affected-device count. It does not identify the version or the reachability of UDP 8211. The zero CVE filter result is also not proof of absence from the internet or from a private network.

Remediation and mitigations

Question one: what exact software is running on every active and standby node? Question two: which systems can receive PAPI traffic from untrusted networks? Question three: what evidence proves the fixed image remains active after restart or failover? Question four: how are unpatched exceptions isolated and monitored? Question five: who owns the remaining risk and when is the next verification?

HPE recommends limiting CLI and web management interfaces to a dedicated Layer 2 segment or VLAN with firewall controls at Layer 3 and above, plus accounting controls for administrative actions. Because the vulnerability path is PAPI on UDP 8211, the assurance record should separately explain how that traffic is restricted and tested.

An acceptable response is not a claim that the estate is safe because a CVE query returned zero. It is a traceable set of version, reachability, patch, exception, and ownership records that can survive an audit and a failover.

References

• HPE Networking CSAF advisory HPESBNW05162: https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
• HPE support bulletin: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
• CVE-2026-79860 record: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/79xxx/CVE-2026-79860.json
• CERT-FR advisory CERTFR-2026-AVI-1369: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1369/
• INCIBE advisory INCIBE-2026-789: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-productos-de-hpe-4