{"id":"CVE-2026-79870","published":"2026-10-22T19:17:59.390","lastModified":"2026-10-26T14:18:54.933","description":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An authentication bypass in AOS-8's PAPI protocol allows unauthenticated adjacent attackers to gain administrative access by circumventing existing authentication controls.","exploitability":"Exploitation requires the attacker to be on the same adjacent network segment (e.g., same LAN or wireless subnet) with no authentication required.","blast_radius":"Successful exploitation grants full administrative control, enabling data theft, configuration changes, and service disruption across affected systems.","remediation":"Upgrade to AOS-8 version 2.590 or later, as this is the fixed version specified in the CVE description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","adjacent-network","admin-access","papi","aos-8"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:47:03.016Z"}}