Aruba AOS-8 wireless controllers: unauthenticated SQL injection leads to OS command execution

1. NVD2026-10-23 21:57 UTC · published 2026-10-22 19:17 UTC · CVE-2026-79848
2. InfraStack analyst2026-10-23 22:01 UTC · published 2026-10-23 22:01 UTC
   “Read HPE advisory HPESBNW05162 (CSAF text, 2026-Oct-22): CVSS 10.0, fixed in 8.13.3.1 / 8.10.0.24. Advisory names no specific interface (just 'affected interface of AOS-8'). HPE says no known public PoC or exploitation; I did not search X or social.”
3. InfraStack analyst2026-10-23 22:46 UTC · published 2026-10-23 22:46 UTC
   “Return visit: no new sources. Triage rerun blanked how-to-check and not-affected-if, so I restored them. Advisory still names no interface, gives no detection method, and doesn't say whether a reachable management port is required. It only recommends restricting CLI/web management access as a workaround.”
4. EPSS2026-10-24 07:15 UTC · CVE-2026-79848

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-79848 · 10-23 21:57
• EPSS: CVE-2026-79848 · 10-24 07:15
• HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisoryAdvisory · InfraStack analyst
• HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisoryFix · InfraStack analyst
• HPE patches eight max severity RCE and auth bypass AOS flawsDescribes it · InfraStack analyst
• CVE Record CVE-2026-79848Mentions it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-79848")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.