CVE-2026-79866

Summary

An unauthenticated path traversal flaw in AOS-8's PAPI protocol lets adjacent attackers read, modify, or delete arbitrary files on the underlying OS without credentials.

Exploitability

Exploitation requires network proximity (adjacent) and no authentication; low complexity makes it straightforward for an attacker in the same broadcast domain.

Blast radius

Full compromise of confidentiality, integrity, and availability on the affected device is possible, potentially enabling lateral movement or persistent access within the local network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AOS-8 patched version 8.10.300 or later, as confirmed by Aruba's advisory; if no fixed version is available, disable PAPI or restrict its access to trusted subnets only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.