CVE-2026-79857

Summary

A command injection flaw in ArubaOS-8's PAPI protocol allows unauthenticated remote code execution via specially crafted UDP packets, enabling attackers to run arbitrary privileged commands on the underlying OS.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication and low attack complexity, requiring only network access to the vulnerable UDP port.

Blast radius

Successful exploitation grants full system compromise as a privileged user, enabling complete data theft, system modification, or service disruption across affected devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AOS-8 version 8.10.100 or later, as patched by Aruba in the June 2026 security advisory (Aruba Security Advisory ASA-2026-0003).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.