by Kastro
Paper/Archive/CVE-2026-79866

CVE-2026-79866

Hewlett Packard Enterprise (HPE) ArubaOS (AOS) — Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8

EPSS 0.2%CVSS 9.6
critical.is priorityof 100
32
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 15.3.153 × 203.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.

Affected

ProductAffectedFixed inSource
ArubaOS (AOS)8.13.0.0 – 8.13.3.0–CNA
ArubaOS (AOS)8.10.0.0 – 8.10.0.23–CNA

Scores by source

hpe (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refsupport.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US