---
id: "CVE-2026-79858"
kind: "vulnerability"
aliases: ["CVE-2026-79858"]
title: "HPE Aruba AOS-8 controllers: unauthenticated SQL injection lets attackers read and change data"
severity: "critical"
cvss: 9.8
epss: 0.00402
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "HPE Networking AOS-8 (ArubaOS)", "fixed": ["8.10.0.24", "8.13.3.1"], "affected": ">= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aos-8", "aruba", "hpe", "infrastructure", "network-appliance", "papi", "sql-injection"]
not_affected_if: ["version-outside-affected-ranges"]
published_at: "2026-10-22T19:17:58+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79858", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:19:01+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-79858", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# HPE Aruba AOS-8 controllers: unauthenticated SQL injection lets attackers read and change data

HPE Aruba AOS-8 controllers have an SQL injection flaw in the PAPI protocol that needs no login. A remote attacker can read and modify the controller's database and interrupt the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:HPE Networking AOS-8 (ArubaOS) affected >= 8.10.0.0, <= 8.10.0.23; >= 8.12.0.0, <= 8.13.3.0 fixed 8.10.0.24, 8.13.3.1

## How to check

Check the AOS-8 version: affected are 8.10.0.0 through 8.10.0.23 and 8.12.0.0 through 8.13.3.0.

## Fix

Upgrade to AOS-8 8.10.0.24 or 8.13.3.1, the fixed releases.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79858
- 2026-10-23T22:19:01+00:00 analyst — Vendor is HPE Networking (Aruba), not Alcatel-Lucent Enterprise; the triage hint was wrong. Advisory HPESBNW05162 (2026-10-22) lists AOS-8 affected <=8.13.3.0 and <=8.10.0.23, fixed in 8.13.3.1 and 8.10.0.24. The CVE-specific Details entry was cut off in the text I could fetch, so the AOS-8 ranges come from the advisory-wide list and the CVE record. HPE reports no known exploitation or public PoC. I did not search social posts.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-79858

## Documents

- [advisory] HPESBNW05162 HPE Networking AOS-8 and AOS-10 advisory https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
- [describes] HPE patches eight max severity RCE and auth bypass AOS flaws https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws/
- [describes] HPE Networking AOS Vulnerabilities Hit PAPI Protocol https://securityonline.info/hpe-networking-aos-vulnerabilities/

## From the sources

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_