Five assurance questions for CVE-2026-79860 in ArubaOS AOS-8

Assurance reviews need answers that can be tested. CVE-2026-79860 affects specific ArubaOS AOS-8 releases and can be reached through PAPI UDP port 8211. HPE rates the buffer overflow at CVSS 3.1 9.8 and says exploitation can execute code as a privileged user.

Those facts lead to five practical questions. They separate confirmed vendor information from assumptions about a particular environment.

Vulnerability overview

HPE Networking published CVE-2026-79860 in HPESBNW05162 on 22 October 2026. The CVE record assigns CWE-120 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H .

HPE describes crafted PAPI packets sent to UDP port 8211 as the trigger for the overflow. Successful exploitation can run arbitrary code with privileged access on the underlying system.

Mechanism and exploitation conditions

The first technical question is whether the affected service is reachable.…