Many wireless security reviews begin with the web management interface. CVE-2026-79857 sits on a different path: the PAPI service that supports access point management over UDP. HPE says crafted packets can reach an unauthenticated command-injection flaw in ArubaOS AOS-8, making protocol visibility as important as patch status.
Vulnerability overview
CVE-2026-79857 is documented in HPE advisory HPESBNW05162 as a critical command-injection weakness. HPE assigns a CVSS 3.1 base score of 9.8 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires no credentials or user interaction.
The CVE record states that specially crafted packets sent to the affected UDP port can result in remote code execution as a privileged user. CISA's enrichment identifies CWE-77 and marks the technical impact as total, while recording exploitation as none. HPE reported no known public exploit code at release.
Mechanism and exploitation conditions
Aruba documentation describes PAPI as an access point management protocol on UDP 8211. It carries controller and access point communication, including configuration functions. HPE's public description says the AOS-8 implementation has a command-injection condition that can be reached with crafted packets.
The vendor does not publish the vulnerable packet format or identify the exact code path. The absence of that detail complicates retrospective detection, but it does not make the service invisible. Firewall logs, flow records, packet captures and management accounting can show which systems can send PAPI traffic to which controllers.
The reachability review should cover UDP 8211 as well as HTTPS. Guest networks, branch links, operations subnets, remote access pools and monitoring systems may each create a path that was not part of the original controller design.
Impact
Successful exploitation can provide privileged command execution on the device operating system. That may allow configuration changes, access to sensitive data and disruption of wireless service. A controller often sits at the center of authentication and access point management, so the aftermath can extend beyond the affected appliance.
The CVSS scores are high for all three impact categories. They do not establish that exploitation occurred or that a public exploit is circulating. They do establish why a reachable vulnerable service deserves priority treatment.
Affected products and scope
The affected AOS-8 branches are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23. Product classes include Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, AOS-8 Instant access points and AOS-8 access points.
Inventory should record the management network and every observed PAPI source or destination. For remote or branch deployments, include the network paths created for access point onboarding. A device that is not internet-facing can still be reachable from a compromised workstation or an overpermissive transit rule.
Exposure context
ZoomEye Search for app="ArubaOS" returned 212 product-fingerprint matches. The CVE Filter vul.cve="CVE-2026-79857" returned 0. Exposure is 212, but the result is a product-fingerprint count and does not confirm vulnerable software or exploitability.
Search: https://www.zoomeye.ai/searchResult?q=YXBwPSJBcnViYU9TIg%3D%3D
Remediation and mitigations
Upgrade AOS-8.13 systems to 8.13.3.1 or later and AOS-8.10 systems to 8.10.0.24 or later. Validate the running version and then verify that the required PAPI paths still work after restricting traffic.
HPE recommends a dedicated layer 2 segment or VLAN for CLI and web management, plus layer 3 firewall policy and accounting. Build a PAPI allowlist that names the controller and access point roles that need to communicate. Remove any broad rule that permits UDP 8211 from general user or operations networks.
Monitor for unusual PAPI packet volumes, malformed traffic and new senders. Check management logs for configuration changes during the exposure window. These controls do not replace the vendor fix, but they close paths that a future vulnerable build could otherwise inherit.