Live › vulnerability › CVE-2026-79849
Go to dashboardHPE Aruba AOS-8 wireless controllers have an SQL injection flaw in an interface that needs no login. An attacker who reaches it can run arbitrary commands on the underlying operating system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AOS-8 (ArubaOS) | vendor | 8.13.x <= 8.13.3.0; 8.10.x <= 8.10.0.23 | 8.13.3.1, 8.10.0.24 |
Check the ArubaOS version on the controller (show version) and compare against affected 8.13.x up to 8.13.3.0 and 8.10.x up to 8.10.0.23.
Upgrade to 8.13.3.1 or 8.10.0.24 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79849")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.