---
id: "CVE-2026-79852"
kind: "vulnerability"
aliases: ["CVE-2026-79852"]
title: "HPE Aruba AOS: unauthenticated SQL injection in web management leads to OS command execution"
severity: "critical"
cvss: 9.8
epss: 0.00505
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AOS-10", "fixed": ["10.8.1.2", "10.7.2.7", "10.4.1.14"], "affected": "<= 10.8.1.1, <= 10.7.2.6, <= 10.4.1.13 (per branch)", "ecosystem": "vendor"}, {"name": "AOS-8", "fixed": ["8.13.3.1", "8.10.0.24"], "affected": "<= 8.13.3.0, <= 8.10.0.23 (per branch)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos", "aruba", "hpe", "infrastructure", "network-devices", "rce", "sql-injection", "web-management"]
not_affected_if: ["fixed-version", "management-interface-not-exposed"]
published_at: "2026-10-22T19:17:57+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79852", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:20:44+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79852", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS: unauthenticated SQL injection in web management leads to OS command execution

HPE Aruba AOS-10 and AOS-8 web management interfaces accept SQL injection from unauthenticated remote attackers. Successful exploitation can let an attacker run arbitrary commands on the underlying operating system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AOS-10 affected <= 10.8.1.1, <= 10.7.2.6, <= 10.4.1.13 (per branch) fixed 10.8.1.2, 10.7.2.7, 10.4.1.14
- vendor:AOS-8 affected <= 8.13.3.0, <= 8.10.0.23 (per branch) fixed 8.13.3.1, 8.10.0.24

## How to check

Compare the running AOS version against the affected ranges: AOS-10 up to 10.8.1.1, 10.7.2.6, 10.4.1.13; AOS-8 up to 8.13.3.0, 8.10.0.23.
Check whether the web management interface is reachable from untrusted networks.

## Fix

Upgrade AOS-10 to 10.8.1.2, 10.7.2.7 or 10.4.1.14, and AOS-8 to 8.13.3.1 or 8.10.0.24, matching your branch.
Restrict access to the web management interface to trusted management networks until patched.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79852
- 2026-10-23T22:20:44+00:00 analyst — HPE advisory HPESBNW05162 (Oct 22 2026) page is JS-only and returned no text; versions taken from BleepingComputer/SecurityOnline/CybersecurityNews/VulDB reporting of it. No exploitation or public PoC reported; not in KEV. Per-branch fixed versions apply to the bulletin as a whole, not verified per CVE on the primary page.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79852

## Documents

- [advisory] HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless OS (AOS-10 & AOS-8) https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
- [describes] HPE Networking AOS Vulnerabilities Hit PAPI Protocol https://securityonline.info/hpe-networking-aos-vulnerabilities/
- [mitigation] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/

## From the sources

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_