{"id":"CVE-2026-79852","kind":"vulnerability","aliases":["CVE-2026-79852"],"related":[],"title":"HPE Aruba AOS: unauthenticated SQL injection in web management leads to OS command execution","description":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","summary":"HPE Aruba AOS-10 and AOS-8 web management interfaces accept SQL injection from unauthenticated remote attackers. Successful exploitation can let an attacker run arbitrary commands on the underlying operating system.","severity":"critical","cvss":9.8,"epss":0.00505,"exploited":false,"exploited_at":null,"products":[{"name":"AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":"<= 10.8.1.1, <= 10.7.2.6, <= 10.4.1.13 (per branch)","ecosystem":"vendor"},{"name":"AOS-8","fixed":["8.13.3.1","8.10.0.24"],"affected":"<= 8.13.3.0, <= 8.10.0.23 (per branch)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos","aruba","hpe","infrastructure","network-devices","rce","sql-injection","web-management"],"not_affected_if":["fixed-version","management-interface-not-exposed"],"how_to_check":"Compare the running AOS version against the affected ranges: AOS-10 up to 10.8.1.1, 10.7.2.6, 10.4.1.13; AOS-8 up to 8.13.3.0, 8.10.0.23.\nCheck whether the web management interface is reachable from untrusted networks.","fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14, and AOS-8 to 8.13.3.1 or 8.10.0.24, matching your branch.\nRestrict access to the web management interface to trusted management networks until patched.","status":"open","published_at":"2026-10-22T19:17:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:32:03+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:32:03Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14, and AOS-8 to 8.13.3.1 or 8.10.0.24, matching your branch.\nRestrict access to the web management interface to trusted management networks until patched.","reach":"network","title":"HPE Aruba AOS: unauthenticated SQL injection in web management leads to OS command execution","impact":"high","summary":"HPE Aruba AOS-10 and AOS-8 web management interfaces accept SQL injection from unauthenticated remote attackers. Successful exploitation can let an attacker run arbitrary commands on the underlying operating system.","category":"infrastructure","who_cares":["aos","aruba","hpe","network-devices","web-management"],"confidence":0.8,"needs_auth":"no","worst_case":"unauthenticated attacker runs arbitrary commands on the controller OS","analyst_note":"Confirm whether the web management interface is enabled by default and whether any workaround exists beyond patching; see https://nvd.nist.gov/vuln/detail/CVE-2026-79852 and the HPE Aruba advisory it cites.","how_to_check":"Compare the running AOS version against the affected ranges: AOS-10 up to 10.8.1.1, 10.7.2.6, 10.4.1.13; AOS-8 up to 8.13.3.0, 8.10.0.23.\nCheck whether the web management interface is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["fixed-version","management-interface-not-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000602,"input_tokens":3069,"output_tokens":590,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify which AOS product and versions are affected and the vendor advisory with fixed releases; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-79852 does not list affected products.","search":"'-10':22A,42B '-2026':16A,19A '-79852':17A,20A '-8':24A,45B 'accept':49B 'allow':82C,99C 'ao':3A,25B,41B,44B,80C,94C 'aos':21A,23A 'arbitrari':63B,104C 'aruba':2A,26B,40B 'attack':55B,61B,86C,91C,101C 'base':76C 'command':13A,64B,105C 'conduct':88C 'could':81C,98C 'cve':15A,18A 'devic':31B 'execut':14A,103C 'exploit':57B,97C 'hpe':1A,27B,39B 'infrastructur':28B 'inject':6A,35B,51B,90C 'instanc':95C 'interfac':48B,78C 'lead':10A 'let':59B 'manag':9A,38B,47B,77C 'network':30B 'network-devic':29B 'oper':68B,109C 'os':12A 'rce':32B 'remot':54B,85C 'run':62B 'sql':5A,34B,50B,89C 'sql-inject':33B 'success':56B,96C 'system':69B,110C 'unauthent':4A,53B,84C 'under':67B,108C 'vulner':71C 'web':8A,37B,46B,75C 'web-bas':74C 'web-manag':36B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79852","severity":null,"published_at":"2026-10-22T19:17:57+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79852:208","url":null,"severity":null,"published_at":"2026-10-23T22:20:44+00:00","modified_at":"2026-10-23T22:20:44+00:00","first_seen_at":"2026-10-23T22:20:44+00:00","fetched_at":"2026-10-23T22:20:44+00:00","note":"HPE advisory HPESBNW05162 (Oct 22 2026) page is JS-only and returned no text; versions taken from BleepingComputer/SecurityOnline/CybersecurityNews/VulDB reporting of it. No exploitation or public PoC reported; not in KEV. Per-branch fixed versions apply to the bulletin as a whole, not verified per CVE on the primary page."},{"source":"epss","external_id":"CVE-2026-79852","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79852","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1255,"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","title":"HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8)","kind":"advisory","source":"analyst","text":"Vendor bulletin 2026-10-22. Page is JS-only; body not readable by tools.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1338,"url":"https://securityonline.info/hpe-networking-aos-vulnerabilities/","title":"HPE Networking AOS Vulnerabilities Hit PAPI Protocol","kind":"blog","source":"analyst","text":"CVE-2026-79861 brings the same command-injection bug type as CVE-2026-79857 to AOS-10. PAPI listens on UDP 8211. Affected: AOS-10.8.0.0-10.8.1.1, 10.6.0.0-10.7.2.6, 10.3.0.0-10.4.1.13. Upgrade to 10.8.1.2, 10.7.2.7 or 10.4.1.14. Limit UDP 8211 to trusted devices.","published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}