HPE Aruba AOS-8 controllers: unauthenticated SQL injection lets attackers read and change data

1. NVD2026-10-23 21:57 UTC · published 2026-10-22 19:17 UTC · CVE-2026-79858
2. InfraStack analyst2026-10-23 22:19 UTC · published 2026-10-23 22:19 UTC
   “Vendor is HPE Networking (Aruba), not Alcatel-Lucent Enterprise; the triage hint was wrong. Advisory HPESBNW05162 (2026-10-22) lists AOS-8 affected <=8.13.3.0 and <=8.10.0.23, fixed in 8.13.3.1 and 8.10.0.24. The CVE-specific Details entry was cut off in the text I could fetch, so the AOS-8 ranges come from the advisory-wide list and the CVE record. HPE reports no known exploitation or public PoC. I did not search social posts.”
3. EPSS2026-10-24 07:15 UTC · CVE-2026-79858

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-79858 · 10-23 21:57
• EPSS: CVE-2026-79858 · 10-24 07:15
• HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisoryAdvisory · InfraStack analyst
• HPE patches eight max severity RCE and auth bypass AOS flawsDescribes it · InfraStack analyst
• HPE Networking AOS Vulnerabilities Hit PAPI ProtocolDescribes it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-79858")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.