CVE-2026-79849

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

No known exploitation. EPSS puts it in the 53rd percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile53rd0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-10-22Updated 2026-10-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Hewlett Packard Enterprise (HPE) ArubaOSAffected: ≥ 8.13.0.0, ≤ 8.13.3.0Upgrade to: after 8.13.3.0Affected: ≥ 8.10.0.0, ≤ 8.10.0.23Upgrade to: after 8.10.0.23Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your network documentation or ask your IT provider whether you run Aruba AOS-8 on any wireless controllers.
If you do, isolate the management interface from the internet and restrict access to trusted internal networks only.
Monitor Aruba's security advisories for CVE-2026-79849 since no fixed version has been released yet.
As soon as a patch is issued, apply it immediately given the severity of this flaw.
In the meantime, review firewall rules to ensure the controller's admin interface is not exposed to the public internet.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

In plain language

Written by AI from the record

A critical, no-login-required flaw in Aruba's AOS-8 network controller software could let attackers take full control of the device, and there's no fix available yet, so you should check if you're affected and watch closely.

Unauthenticated SQL injection (CWE-89) in AOS-8 allows remote code execution via crafted database queries, rated maximum severity (CVSS 10) with no vendor patch currently published.

If you're affected

Full network device takeover
Operational disruption to wireless/network access
Lateral movement into internal network
Data interception risk

What is it

AOS-8 is software that runs Aruba's wireless network controllers — think of it as the traffic cop directing all the Wi-Fi traffic in your office. This flaw is like a hidden door in that traffic cop's control room that anyone can walk through without a key, letting them seize control of the whole system and potentially everything connected to it.

Who is affected

This matters to you if your business uses Aruba AOS-8 wireless network controllers to manage Wi-Fi or network access. It affects the system whether or not an attacker has valid login credentials, so exposure depends mainly on whether the controller's management interface is reachable from the internet.

How urgent is it

This flaw is rated at the highest possible severity and requires no login to exploit, but there is no confirmed evidence yet of attackers actively using it and no public exploit code exists. Because a vendor fix is not yet available, treat this as a serious risk to address through access restrictions now, and apply a patch the moment one is released.

What to do — in detail

Inventory all Aruba AOS-8 controller instances and confirm exact software version. 2. Check Aruba's security advisory portal for CVE-2026-79849 — no fixed version is published as of this writing, so there is no target version to upgrade to yet. 3. As a temporary mitigation, restrict management/API interfaces to trusted internal IP ranges via firewall/ACL, and disable any unnecessary exposed services. 4. Since this is not in CISA KEV and no public exploit code or confirmed in-the-wild exploitation has been reported, prioritize as high-but-not-emergency — unless internet-facing, in which case treat as emergency. 5. Subscribe to Aruba/HPE security bulletins for patch release; apply immediately once available given the CVSS 10 rating and unauthenticated SQLi-to-RCE chain. 6. Monitor controller logs for anomalous database query patterns or unexpected admin actions as an interim detection measure.

Technical context

CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects network-exploitable, low-complexity, no-privilege, no-interaction SQL injection (CWE-89) leading to remote code execution with full confidentiality/integrity/availability impact and scope change. Not listed in CISA KEV, no public exploit code identified, and no EPSS data provided — exploitation is not confirmed in the wild. No patch is currently available from the vendor. Press attention is newly emerging, which should not be mistaken for active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS53rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 53rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 1 day, from the signal feeds we watch.

2026-10-23Record updatedrecord updated, record updated
2026-10-22Publishedweakness classified, att&ck mapped, record updated

Affected products

Hewlett Packard Enterprise (HPE)commercial · USaka hewlett packard enterprise
- ArubaOS (AOS)Hardware Firmware

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable