CVE-2026-79849 PUBLISHED

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Assigner: hpe
Reserved: 25.08.2026 Published: 22.10.2026 Updated: 23.10.2026

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor Hewlett Packard Enterprise (HPE)
Product ArubaOS (AOS)
Versions Default: affected
  • affected from 8.13.0.0 to 8.13.3.0 (incl.)
  • affected from 8.10.0.0 to 8.10.0.23 (incl.)

Credits

  • Internal security research (HPE Networking). reporter
  • This vulnerability was reported by moonv to the HPE Networking Bug Bounty program. reporter

References