CVE-2026-79860 is a remote-code-execution flaw in ArubaOS 8 (AOS-8), HPE Aruba Networking’s platform for centrally managed wireless networks. It matters to the teams running Mobility Conductors, physical or virtual Mobility Controllers, and controller-managed access points—not to operators of AOS-CX switches. Those systems coordinate APs, clients, roaming, radio configuration and policy across campus or multi-site WLANs, making them common in enterprise environments with substantial wireless estates.
The issue sits in an underlying AOS-8 service that handles PAPI, Aruba’s access-point management protocol. An unauthenticated attacker can send specially crafted packets to PAPI on UDP port 8211 and trigger a buffer overflow: input overruns a fixed-size memory area and can alter program execution. The stated outcome is arbitrary code execution as a privileged user on the underlying operating system. In practical terms, the prerequisite is network reachability to that UDP service; the attacker does not need a valid ArubaOS account or user interaction.
A management path that must not be broadly reachable
PAPI is part of the control relationship between wireless infrastructure components, not an application-facing service an ordinary client should need. That makes routing, firewall policy, VPN boundaries and segmentation central to exposure. Inventory Mobility Conductors and Controllers first, then establish whether UDP 8211 is reachable from untrusted networks, general user VLANs, guest wireless, or other unnecessarily broad segments.
HPE’s affected-version and fix information is specific: AOS-8.13.0.0 through 8.13.3.0 need to move to 8.13.3.1 or later, while AOS-8.10.0.0 through 8.10.0.23 need 8.10.0.24 or later. Releases that have reached End of Maintenance are presumed affected but are not covered by the advisory; releases past End of Support were not assessed and should be treated as potentially affected. Those deployments need migration to a supported fixed branch, rather than waiting for an update on the old one.
Patch first; use segmentation as containment
Apply the fixed release through normal controller upgrade planning, including configuration backup, high-availability and AP interoperability checks. Until then, explicitly restrict UDP 8211 to the infrastructure peers that require it and log denied and permitted traffic where feasible. HPE also recommends isolating CLI and web management on a dedicated Layer 2 segment or with Layer 3 firewall policy, but its bulletin does not say that generic management-interface guidance specifically blocks the PAPI path. Validate the actual UDP rule rather than assuming it does.
The same broad bulletin includes other AOS issues, among them CVE-2026-79846 and CVE-2026-79858, but this flaw deserves separate priority because no authentication precedes the vulnerable packet handling. ArubaOS 8 provides the centralized functions that make large wireless deployments manageable; compromise at that layer can have consequences beyond one access point.
No confirmed public exploitation so far
As of October 26, 2026, no public proof of concept or exploit code had surfaced, and no confirmed incident, campaign or threat actor had been connected to CVE-2026-79860. HPE said it was unaware of public discussion or exploit code when its bulletin was released. The CVE is also absent from the CISA Known Exploited Vulnerabilities catalogue reviewed at that time. That is useful context, not a reason to defer remediation: absence from KEV does not establish that nobody has exploited it.
Prioritize externally or broadly reachable controllers, close unnecessary PAPI paths, and get onto a fixed supported release. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which is particularly useful when wireless-controller firmware falls outside the usual server patching cycle.
