{"id":"CVE-2026-79854","kind":"vulnerability","aliases":["CVE-2026-79854"],"related":[],"title":"HPE AOS-10 wireless controllers: unauthenticated SQL injection leads to OS command execution","description":"A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","summary":"HPE Networking AOS-10 has an SQL injection flaw in an exposed interface that needs no login. A remote attacker can run arbitrary commands on the underlying operating system of the AOS-10 instance.","severity":"critical","cvss":9.8,"epss":0.00505,"exploited":false,"exploited_at":null,"products":[{"name":"HPE Networking AOS-10","fixed":["10.8.1.2","10.7.2.7","10.4.1.14"],"affected":">= 10.8.0.0, <= 10.8.1.1; <= 10.7.2.6; <= 10.4.1.13","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["aos-10","aruba","hpe","infrastructure","network-gear","rce","sql-injection","wireless"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"Check the installed AOS-10 version against the affected ranges: 10.8.0.0 to 10.8.1.1, up to 10.7.2.6, and up to 10.4.1.13.","fix":"Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, depending on your branch.","status":"open","published_at":"2026-10-22T19:17:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:32:01+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:32:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 10.8.1.2, 10.7.2.7, or 10.4.1.14, depending on your branch.\nunknown","reach":"network","title":"HPE AOS-10 wireless controllers: unauthenticated SQL injection leads to OS command execution","impact":"high","summary":"HPE Networking AOS-10 has an SQL injection flaw in an exposed interface that needs no login. A remote attacker can run arbitrary commands on the underlying operating system of the AOS-10 instance.","category":"infrastructure","who_cares":["aos-10","aruba","hpe","wireless","network-gear"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary OS commands on the controller","analyst_note":"Confirm which interface is exposed and whether the vendor advisory gives a mitigation or a check command; see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-79854.","how_to_check":"Check the installed AOS-10 version against the affected ranges: 10.8.0.0 to 10.8.1.1, up to 10.7.2.6, and up to 10.4.1.13.\nunknown","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000548,"input_tokens":3034,"output_tokens":489,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory and affected AOS-10 versions and the specific interface; NVD entry has no product or version data, so check HPE/Aruba security bulletins.","search":"'-10':3A,23A,25B,40B,69B,79C,94C '-2026':15A,18A '-79854':16A,19A 'affect':75C 'allow':81C,99C 'ao':2A,24B,39B,68B,78C,93C 'aos':22A 'arbitrari':59B,104C 'aruba':26B 'attack':56B,85C,90C,101C 'command':12A,60B,105C 'conduct':87C 'control':5A 'could':80C,98C 'cve':14A,17A 'execut':13A,103C 'exploit':97C 'expos':48B 'flaw':45B 'gear':31B 'hpe':1A,20A,27B,37B 'infrastructur':28B 'inject':8A,35B,44B,89C 'instanc':70B,95C 'interfac':49B,76C 'lead':9A 'login':53B 'need':51B 'network':30B,38B 'network-gear':29B 'networking':21A 'oper':64B,109C 'os':11A 'rce':32B 'remot':55B,84C 'run':58B 'sql':7A,34B,43B,88C 'sql-inject':33B 'success':96C 'system':65B,110C 'unauthent':6A,83C 'under':63B,108C 'vulner':72C 'wireless':4A,36B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-alert@hpe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79854","severity":null,"published_at":"2026-10-22T19:17:57+00:00","modified_at":"2026-10-23T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-79854:206","url":null,"severity":null,"published_at":"2026-10-23T22:21:37+00:00","modified_at":"2026-10-23T22:21:37+00:00","first_seen_at":"2026-10-23T22:21:37+00:00","fetched_at":"2026-10-23T22:21:37+00:00","note":"Read HPE advisory HPESBNW05162 (22 Oct 2026): CVE-2026-79854 is unauthenticated SQLi to RCE in AOS-10, CVSS 9.8. Advisory names no specific interface ('the affected interface'), so I did not name one. No exploitation or PoC found; I did not search X or HN."},{"source":"epss","external_id":"CVE-2026-79854","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-79854","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1280,"url":"https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt","title":"HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1256,"url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","kind":"blog","source":"analyst","text":"Secondary. Quotes HPE advisory: restrict CLI and web management interfaces to dedicated L2 VLAN and/or L3+ firewall; HPE not aware of public discussion or exploit code as of release. Does not list this CVE or fixed versions.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}