---
id: CVE-2026-79852
title: >-
  Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based
  Management Interface
summary: >-
  A vulnerability in the web-based management interface of AOS could allow an
  unauthenticated remote attacker to conduct SQL injection attacks against the
  AOS instance. Successful exploitation could allow an attacker to execute
  arbitrary c…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Hewlett Packard Enterprise (HPE)
product: ArubaOS (AOS)
affected:
  - arubaos_aos >= 10.8.0.0 <= 10.8.1.1
  - arubaos_aos >= 10.7.0.0 <= 10.7.2.6
  - arubaos_aos >= 10.4.0.0 <= 10.4.1.13
  - arubaos_aos >= 8.13.0.0 <= 8.13.3.0
  - arubaos_aos >= 8.10.0.0 <= 8.10.0.23
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-23T15:16:38.662721Z'
published: '2026-10-22'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T03:55:22.585Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79852'
references:
  - url: >-
      https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
tags:
  - cve.org
epss: 0.00641
epssPercentile: 0.50887
ingestedAt: '2026-10-22T22:00:50.376Z'
---

## Overview

A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

## Affected

- `arubaos_aos >= 10.8.0.0 <= 10.8.1.1`
- `arubaos_aos >= 10.7.0.0 <= 10.7.2.6`
- `arubaos_aos >= 10.4.0.0 <= 10.4.1.13`
- `arubaos_aos >= 8.13.0.0 <= 8.13.3.0`
- `arubaos_aos >= 8.10.0.0 <= 8.10.0.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.