Hewlett Packard Enterprise (HPE) released security updates addressing three critical vulnerabilities (CVE-2026-42505, CVE-2026-42506, and CVE-2026-42507; CVSS 9.8) in HPE Aruba Networking Access Points. The flaws reside within the Command Line Interface (CLI) service exposed on devices running Instant AOS-8 and AOS-10 firmware. Unauthenticated remote adversaries can exploit the weaknesses by transmitting specially crafted management packets to UDP port 8211, the listening port for Aruba’s proprietary Process Application Programming Interface (PAPI).

Processing malformed PAPI datagrams triggers unauthenticated command injection in the underlying CLI parsing daemon, enabling arbitrary code execution with elevated root operating system privileges without requiring administrative credentials. The vulnerabilities, reported via HPE’s bug bounty program by researcher Erik De Jong, affect Instant AOS-8.10.0.13, 8.12.0.1, AOS-10.4.1.3, and 10.6.0.2 and below. While HPE observed no active in-the-wild weaponization, administrators unable to deploy patched AOS builds immediately must enable cluster-security on AOS-8 or drop ingress UDP 8211 traffic on AOS-10.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated command injection in the PAPI daemon converts uninspected UDP control packets into root execution, weaponizing wireless edge infrastructure and allowing network pivots that completely bypass web application firewalls and host authentication tiers.
• Bullet 2 — Strategic & Defender Imperative: Network operations teams must immediately restrict or block UDP port 8211 at all network boundaries, enforce cluster-security authentication for Instant AOS clusters, and upgrade access point fleets to AOS-10.4.1.4, 10.6.0.3, 10.7.0.0, or Instant AOS-8.10.0.14+.