{"id":"CVE-2026-79870","published":"2026-10-22T19:17:59Z","modified":"2026-10-26T14:18:54Z","title":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker…","vendor":"Hewlett Packard Enterprise (HPE)","product":"ArubaOS (AOS)","tier":"core","eol":null,"description":{"text":"An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.","provenance":"source","from":"NVD"},"summary":{"text":"An authentication bypass in the PAPI protocol of ArubaOS (AOS) from Hewlett Packard Enterprise (HPE) lets an attacker circumvent existing authentication controls. An unauthenticated attacker on an adjacent network can exploit it without user interaction to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:13Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0027,"percentile":0.19211,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":6,"pulses":[{"name":"Known_Cve | Oct 31, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ae4af0017a739f65534f550","created":"2026-10-30"},{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae0ba8e2d29f6aa1bfe6f11","created":"2026-10-27"},{"name":"Known_Cve | Oct 27, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6adf68c4585d98c8d3af5bea","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6adb7421f0eaee440740fbf3","created":"2026-10-23"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-108370","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108370","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-22","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79870","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":12.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":3.84,"detail":"percentile 0.1921"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}