Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8

Five key questions arise regarding CVE-2026-79860 in ArubaOS AOS-8. This vulnerability impacts specific versions of the ArubaOS AOS-8 operating system and can be exploited through the PAPI UDP port 8211. The buffer overflow vulnerability, rated CVSS 3.1 9.8 by HPE, allows for privileged code execution.

Key certainty questions include: 1) Is the affected service reachable, given that authentication is not required but network access and packet crafting are needed? 2) Does the specific AOS-8 release version fall within the affected range? 3) Is the exact release version impacted or the patched one? 4) What evidence confirms the fixed image remains active post-restart or failover? 5) Who is accountable for the residual risk and when should the next verification occur?

ArubaOS AOS-8 products affected encompass Mobility Conductors, Controllers, Gateways managed by HPE Networking Central, and Instant Access Points. The vulnerability is believed to affect all versions within the specified ranges unless HPE explicitly excludes end-of-maintenance products. The assurance review must detail which devices run AOS-8, their branch and build, and confirm their support status.

ZoomEye reports 211 product matches for the ArubaOS application, but this count does not equate to affected devices. A thorough review must identify each device's version and verify the reachability of UDP port 8211. Active exploitation campaigns have not been established, but the assurance review should outline potential business impacts without conflating maximum impact with actual incidents.

HPE advises limiting administrative interfaces to a dedicated Layer 2 segment or VLAN, implementing firewall controls at Layer 3, and accounting for administrative actions. The remediation should include a clear explanation of how PAPI traffic on UDP 8211 is restricted and tested. Simply claiming safety due to a zero CVE query is insufficient; a verifiable set of version, reachability, patch, exception, and ownership records must be maintainable through audits and failovers.