CVE-2026-95712 Hewlett Packard Enterprise (HPE) CVE debrief

Who should care

Defenders responsible for ArubaOS (AOS) deployments, particularly those using versions 8.13.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-95712 is a high-severity vulnerability in ArubaOS (AOS) that allows unauthenticated adjacent attackers to disclose sensitive information and disrupt service availability via the PAPI protocol. Defenders should assess exposure, prioritize remediation, and verify affected versions.

• Potential disruption to service availability
• Possible disclosure of sensitive information

Technical summary

The vulnerability in ArubaOS (AOS) allows unauthenticated adjacent attackers to access limited information and disrupt service availability via the PAPI protocol. Affected versions include 8.13.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23. The vulnerability has a high severity score and defenders should prioritize verifying affected ArubaOS versions, assessing exposure to the PAPI protocol, and applying vendor remediation. Limited information is available on exploitation, but defenders should review official advisories and assess exposure.

Defensive priority

Defenders should prioritize verifying affected ArubaOS versions, assessing exposure to the PAPI protocol, and applying vendor remediation.

Recommended defensive actions

• Verify affected ArubaOS versions and assess exposure to the PAPI protocol
• Apply vendor remediation for affected versions
• Monitor for potential disruptions to service availability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impacts. However, additional information on exploitation, victims, or specific business impacts is limited. Defenders should verify affected ArubaOS versions, assess exposure to the PAPI protocol, and monitor for potential disruptions to service availability. The official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.