CVE-2026-79848

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

No known exploitation. EPSS puts it in the 53rd percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile53rd0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-22Updated 2026-10-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Hewlett Packard Enterprise (HPE) ArubaOSAffected: ≥ 8.13.0.0, ≤ 8.13.3.0Upgrade to: after 8.13.3.0Affected: ≥ 8.10.0.0, ≤ 8.10.0.23Upgrade to: after 8.10.0.23Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your business uses Aruba wireless controllers or switches running AOS-8 (ask your network admin or IT provider).
Confirm whether the device's management interface is reachable from the internet — if so, restrict it immediately to trusted internal networks only.
Contact Aruba support or your reseller to ask for the patched software version and an expected release date, since no fix is available yet.
Once Aruba releases a fix, apply it as soon as possible given the severity of this flaw.
In the meantime, isolate management access behind a firewall or VPN and disable any unnecessary remote administration features.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

In plain language

Written by AI from the record

A critical, maximum-severity flaw in Aruba's AOS wireless/network controller software could let an attacker take full control of the device without even logging in, but there's no sign yet that criminals are actively exploiting it and no fix has been released yet.

Unauthenticated SQL injection in ArubaOS (AOS-8) allows remote code execution via crafted database queries, with no public exploit or confirmed in-the-wild activity reported yet and no vendor patch currently available.

If you're affected

Full network device takeover
Network-wide traffic interception
Operational disruption from device compromise
Lateral movement into internal network
Wireless/network outage risk

What is it

Think of this like a backdoor combination lock on your office's network control panel that nobody needs a key to open — someone outside could reach in, bypass the lock entirely, and take over the system that manages your company's wireless network. Because the flaw lives in the device that controls network traffic, an attacker who gets in could see or redirect everything passing through it.

Who is affected

This matters to you if your business uses Aruba wireless network controllers or switches running AOS-8 software (sometimes just called ArubaOS). It is most urgent if the device's management interface is reachable from the internet rather than kept on a protected internal network.

How urgent is it

This is a maximum-severity flaw that doesn't require any login to exploit, which is serious, but there is currently no evidence of attackers using it in the wild, no public exploit code, and the predicted likelihood of near-term attacks is low. Treat this as a priority to track and prepare for, not a five-alarm emergency to drop everything for today — act promptly once a patch becomes available.

What to do — in detail

Inventory all Aruba AOS-8 devices (controllers, mobility conductors, access points managed under AOS-8) and confirm exact software version.
Immediately audit exposure: ensure management/web-UI and API interfaces are not reachable from the public internet; restrict access to a management VLAN or VPN.
No fixed version has been published yet per available findings — monitor Aruba's security advisories closely for a patch release and apply it as soon as it is issued, given the CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rating.
As a temporary workaround, place management interfaces behind firewall rules allowing only trusted administrative IP ranges, and disable unused remote-management services.
Not currently listed in CISA KEV and no exploit code or confirmed exploitation has been reported, so there is no CISA remediation deadline at this time — but reassess urgency if that status changes.
Monitor Aruba's advisory feed, vendor security bulletins, and threat intel sources for updates on exploitation status or exploit code publication; escalate internally the moment either appears.

Technical context

CVE-2026-79848 is an unauthenticated SQL injection (CWE-89) in ArubaOS (AOS-8) rated CVSS 3.1 10.0 Critical (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction, full confidentiality/integrity/availability impact with scope change), enabling remote code execution. It is not listed in CISA's Known Exploited Vulnerabilities catalog, no public proof-of-concept or exploit code has been identified, and EPSS scores it at the 45th percentile with a flat trend, indicating low predicted near-term exploitation probability despite the severity. No vendor patch is currently available per available findings; press attention is newly emerging, which may increase scrutiny and accelerate both research and attacker interest.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS53rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 53rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 1 day, from the signal feeds we watch.

2026-10-23Record updatedrecord updated, record updated
2026-10-22Publishedweakness classified, att&ck mapped, record updated

Affected products

Hewlett Packard Enterprise (HPE)commercial · USaka hewlett packard enterprise
- ArubaOS (AOS)Hardware Firmware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable