CVE-2026-79857
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management…
- Risk score
- 78/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 1.3%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- There is a command injection vulnerability in the PAPI protocol of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets. This allows execution of arbitrary code as a privileged user on the underlying operating system.
- Affected
- {'product': 'AOS-8', 'protocol': 'PAPI'}
- Fix
- Check the linked advisory for details on mitigation and potential fixes.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Last activity 22 Oct 2026. Patch Forecast updates every hour.