{"id":"CVE-2026-79866","published":"2026-10-22T19:17:58.960","lastModified":"2026-10-26T14:18:54.933","description":"An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated path traversal flaw in AOS-8's PAPI protocol lets adjacent attackers read, modify, or delete arbitrary files on the underlying OS without credentials.","exploitability":"Exploitation requires network proximity (adjacent) and no authentication; low complexity makes it straightforward for an attacker in the same broadcast domain.","blast_radius":"Full compromise of confidentiality, integrity, and availability on the affected device is possible, potentially enabling lateral movement or persistent access within the local network.","remediation":"Upgrade to AOS-8 patched version 8.10.300 or later, as confirmed by Aruba's advisory; if no fixed version is available, disable PAPI or restrict its access to trusted subnets only.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["path-traversal","adjacent-attack","unauthenticated","aos8","papi"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:44:57.210Z"}}