Live › vulnerability › CVE-2026-79854
Go to dashboardHPE Networking AOS-10 has an SQL injection flaw in an exposed interface that needs no login. A remote attacker can run arbitrary commands on the underlying operating system of the AOS-10 instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| HPE Networking AOS-10 | vendor | >= 10.8.0.0, <= 10.8.1.1; <= 10.7.2.6; <= 10.4.1.13 | 10.8.1.2, 10.7.2.7, 10.4.1.14 |
Check the installed AOS-10 version against the affected ranges: 10.8.0.0 to 10.8.1.1, up to 10.7.2.6, and up to 10.4.1.13.
Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, depending on your branch.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
This page as .md · .json · in your agent: get_signal("CVE-2026-79854")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.