CVE-2026-95716 Hewlett Packard Enterprise (HPE) CVE debrief

Who should care

Defenders of HPE ArubaOS (AOS) systems, particularly those using versions 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6, and 10.4.0.0 through 10.4.1.13, should assess exposure and prioritize verification and updates. They should also implement compensating controls and monitor for suspicious activity to detect potential exploitation.

Why it matters

CVE-2026-95716 is a medium-severity authentication bypass vulnerability in the PAPI protocol of AOS-10, allowing unauthorized configuration changes. Defenders of HPE ArubaOS (AOS) systems should assess exposure and prioritize verification and updates.

• Verify and update affected AOS versions to prevent unauthorized configuration changes
• Implement compensating controls to limit the attack surface
• Monitor for suspicious activity to detect potential exploitation

Technical summary

CVE-2026-95716 is an authentication bypass vulnerability in the PAPI protocol of AOS-10, allowing unauthorized configuration changes. The vulnerability allows an unauthenticated adjacent attacker to circumvent existing authentication controls, potentially leading to unauthorized configuration changes. Defenders should prioritize verifying and updating affected AOS versions, implementing compensating controls, and monitoring for suspicious activity. The affected versions are 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6, and 10.4.0.0 through 10.4.1.13.

Defensive priority

Defenders should prioritize verifying and updating affected AOS versions, implementing compensating controls, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update affected AOS versions
• Implement compensating controls
• Monitor for suspicious activity
• Review and update security configurations
• Conduct vulnerability assessments
• Implement asset inventory management
• Track changes and updates

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. HPE ArubaOS (AOS) versions 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6, and 10.4.0.0 through 10.4.1.13 are affected. The vulnerability allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to change the state of certain settings of a vulnerable system. Defenders should verify and update affected AOS versions, implement compensating controls, and monitor for suspicious activity

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.