---
id: "CVE-2026-79848"
kind: "vulnerability"
aliases: ["CVE-2026-79848"]
title: "Aruba AOS-8 wireless controllers: unauthenticated SQL injection leads to OS command execution"
severity: "critical"
cvss: 10.0
epss: 0.00704
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": ">= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "rce", "self-hosted", "sql-injection", "unauthenticated", "wireless-controller"]
not_affected_if: ["aos-10-only", "fixed-version-installed", "unaffected-version"]
published_at: "2026-10-22T19:17:56+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79848", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:01:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:46:05+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79848", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Aruba AOS-8 wireless controllers: unauthenticated SQL injection leads to OS command execution

HPE Aruba AOS-8 wireless controllers have an SQL injection flaw in an exposed interface that needs no login. An attacker can run arbitrary commands on the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-8 affected >= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0 fixed 8.13.3.1, 8.10.0.24

## How to check

Run 'show version' on each Mobility Conductor/Controller, or check the Instant AP firmware version. You are affected on AOS-8.13.x up to 8.13.3.0 or AOS-8.10.x up to 8.10.0.23. The CVE record also lists 8.12.0.0 and later. End-of-maintenance releases are presumed affected. HPE publishes no detection signature or indicators and does not name the vulnerable interface. Treat any controller whose CLI or web management is reachable from untrusted networks as most exposed.

## Fix

Upgrade to AOS-8 8.13.3.1 or 8.10.0.24, per the fixed versions listed.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79848
- 2026-10-23T22:01:57+00:00 analyst — Read HPE advisory HPESBNW05162 (CSAF text, 2026-Oct-22): CVSS 10.0, fixed in 8.13.3.1 / 8.10.0.24. Advisory names no specific interface (just 'affected interface of AOS-8'). HPE says no known public PoC or exploitation; I did not search X or social.
- 2026-10-23T22:46:05+00:00 analyst — Return visit: no new sources. Triage rerun blanked how-to-check and not-affected-if, so I restored them. Advisory still names no interface, gives no detection method, and doesn't say whether a reachable management port is required. It only recommends restricting CLI/web management access as a workaround.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79848

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
- [fix] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [mentions] CVE Record CVE-2026-79848 https://www.cve.org/CVERecord?id=CVE-2026-79848

## From the sources

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_