{"id":"CVE-2026-79848","kind":"vulnerability","aliases":["CVE-2026-79848"],"related":[],"title":"Aruba AOS-8 wireless controllers: unauthenticated SQL injection leads to OS command execution","description":"Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","summary":"HPE Aruba AOS-8 wireless controllers have an SQL injection flaw in an exposed interface that needs no login. An attacker can run arbitrary commands on the underlying operating system.","severity":"critical","cvss":10.0,"epss":0.00704,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":">= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-8","aruba","hpe","infrastructure","network-appliance","rce","self-hosted","sql-injection","unauthenticated","wireless-controller"],"not_affected_if":["aos-10-only","fixed-version-installed","unaffected-version"],"how_to_check":"Run 'show version' on each Mobility Conductor/Controller, or check the Instant AP firmware version. You are affected on AOS-8.13.x up to 8.13.3.0 or AOS-8.10.x up to 8.10.0.23. The CVE record also lists 8.12.0.0 and later. End-of-maintenance releases are presumed affected. HPE publishes no detection signature or indicators and does not name the vulnerable interface. Treat any controller whose CLI or web management is reachable from untrusted networks as most exposed.","fix":"Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, per the fixed versions listed.","status":"open","published_at":"2026-10-22T19:17:56+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:05+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:32:05Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, per the fixed versions listed.","reach":"unknown","title":"Aruba AOS-8 wireless controllers: unauthenticated SQL injection leads to OS command execution","impact":"high","summary":"HPE Aruba AOS-8 wireless controllers have an SQL injection flaw in an exposed interface that needs no login. An attacker can run arbitrary commands on the underlying operating system.","category":"infrastructure","who_cares":["aos-8","aruba","wireless-controller","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs commands as root on the controller.","analyst_note":"Confirm which interface is affected and whether the flaw needs a reachable management port; check the HPE Aruba advisory for a detection method.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unaffected-version"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000495,"input_tokens":3036,"output_tokens":382,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm which interface is affected and whether the flaw needs a reachable management port; check the HPE Aruba advisory for a detection method.","search":"'-2026':15A,18A '-79848':16A,19A '-8':3A,21A,23B,44B,78C,94C 'affect':74C,92C 'allow':80C,99C 'ao':2A,22B,43B,77C,93C 'aos':20A 'applianc':29B 'arbitrari':64B,104C 'aruba':1A,24B,42B 'attack':61B,84C,89C,101C 'command':12A,65B,105C 'conduct':86C 'control':5A,40B,46B 'could':79C,98C 'cve':14A,17A 'execut':13A,103C 'exploit':97C 'expos':54B 'flaw':51B 'host':33B 'hpe':25B,41B 'infrastructur':26B 'inject':8A,36B,50B,88C 'instanc':95C 'interfac':55B,75C 'lead':9A 'login':59B 'need':57B 'network':28B 'network-appli':27B 'oper':69B,109C 'os':11A 'rce':30B 'remot':83C 'run':63B 'self':32B 'self-host':31B 'sql':7A,35B,49B,87C 'sql-inject':34B 'success':96C 'system':70B,110C 'unauthent':6A,37B,82C 'under':68B,108C 'vulner':71C 'wireless':4A,39B,45B 'wireless-control':38B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79848","severity":null,"published_at":"2026-10-22T19:17:56+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79848:155","url":null,"severity":null,"published_at":"2026-10-23T22:01:57+00:00","modified_at":"2026-10-23T22:01:57+00:00","first_seen_at":"2026-10-23T22:01:57+00:00","fetched_at":"2026-10-23T22:01:57+00:00","note":"Read HPE advisory HPESBNW05162 (CSAF text, 2026-Oct-22): CVSS 10.0, fixed in 8.13.3.1 / 8.10.0.24. Advisory names no specific interface (just 'affected interface of AOS-8'). HPE says no known public PoC or exploitation; I did not search X or social."},{"source":"analyst","external_id":"CVE-2026-79848:296","url":null,"severity":null,"published_at":"2026-10-23T22:46:05+00:00","modified_at":"2026-10-23T22:46:05+00:00","first_seen_at":"2026-10-23T22:46:05+00:00","fetched_at":"2026-10-23T22:46:05+00:00","note":"Return visit: no new sources. Triage rerun blanked how-to-check and not-affected-if, so I restored them. Advisory still names no interface, gives no detection method, and doesn't say whether a reachable management port is required. It only recommends restricting CLI/web management access as a workaround."},{"source":"epss","external_id":"CVE-2026-79848","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79848","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1282,"url":"https://www.cve.org/CVERecord?id=CVE-2026-79848","title":"CVE Record CVE-2026-79848","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}