Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.
Critical 9.3
CVE-2026-79873
HPE ArubaOS (AOS) — authentication bypass.
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls.
WeaknessCWE-287: Authentication bypass
Published Updated Source NVD
CVSS 3.1
9.3
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Exploit chance, 30 days
0.2%
Higher than 15% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run HPE ArubaOS (AOS), and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in HPE ArubaOS (AOS)
31 more CVEs
9.3HPE ArubaOS (AOS) — information disclosure.EPSS 0.2%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — remote code execution.EPSS 0.3%9.6HPE ArubaOS (AOS) — authentication bypass.EPSS 0.3%9.6HPE ArubaOS (AOS) — information disclosure.EPSS 0.3%