HPE patches three critical security holes in Aruba PAPI

Aruba access points running AOS-8 and AOS-10 require urgent patching after HPE released fixes for three critical (CVSS 9.8) vulnerabilities that allow unauthenticated remote code execution via UDP port 8211 (PAPI); affected versions include AOS 10.6.x and Instant AOS 8.12.x (and earlier/end-of-life releases). HPE recommends enabling cluster-security on Instant AOS-8.x or blocking UDP 8211 from untrusted networks for AOS-10, and notes no evidence of in-the-wild exploitation at the time of publication.