{"id":"CVE-2026-79875","published":"2026-10-22T19:17:59.943","lastModified":"2026-10-26T14:18:54.933","description":"A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The PAPI protocol in AOS-8 contains a flaw that allows an unauthenticated adjacent attacker to bypass authentication controls, potentially leading to administrative access and unauthorized data manipulation.","exploitability":"Exploitation requires the attacker to be on the same network segment (adjacent) with no authentication or user interaction needed.","blast_radius":"Successful exploitation could grant full administrative control over affected systems, enabling attackers to modify configurations and access sensitive data within the network segment.","remediation":"Upgrade to AOS-8 version 2.590 or later, as this is the fixed version that addresses CVE-2026-79875.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["adjacent-attack","auth-bypass","admin-access","papi","aos-8"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:48:48.219Z"}}