# CVE-2026-79870: Authentication Bypass leads to Unauthorized Access in AOS-8

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Hewlett Packard Enterprise (HPE) / ArubaOS (AOS): ≥ 8.13.0.0; ≤ 8.13.3.0 (affected, semver); ≥ 8.10.0.0; ≤ 8.10.0.23 (affected, semver). Source: CNA: hpe

## Severity and prioritization

- CVSS 3.1: 9.6 (critical); CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; source: CNA: hpe

- CISA KEV: No listing in collected sources

- EPSS: 0.27% as of 2026-11-01; percentile 19.21%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-287

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US (CNA: hpe)

## Provenance

- CNA: hpe: https://www.cve.org/CVERecord?id=CVE-2026-79870; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-79870; retrieved 2026-11-02; source updated Not reported

Revision: 51c2d5c400759e314959e278cedd07daab9f617193c5a6e4bfd6f7618cc88a30

Canonical: https://y2.dev/cve/CVE-2026-79870