CVE-2026-79852 PUBLISHED

Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface

Assigner: hpe
Reserved: 25.08.2026 Published: 22.10.2026 Updated: 24.10.2026

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Hewlett Packard Enterprise (HPE)
Product ArubaOS (AOS)
Versions Default: affected
  • affected from 10.8.0.0 to 10.8.1.1 (incl.)
  • affected from 10.7.0.0 to 10.7.2.6 (incl.)
  • affected from 10.4.0.0 to 10.4.1.13 (incl.)
  • affected from 8.13.0.0 to 8.13.3.0 (incl.)
  • affected from 8.10.0.0 to 8.10.0.23 (incl.)

Credits

  • This vulnerability was reported by moonv to the HPE Networking Bug Bounty program. reporter

References