HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
CVE-2026-79852
Unauthenticated SQL injection to OS commands in AOS web UI
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A SQL injection flaw in the web-based management interface of AOS lets an unauthenticated remote attacker send crafted requests with no user interaction. Successful exploitation can run arbitrary commands on the underlying operating system. AOS instances that expose this management interface are affected; no affected or fixed versions are stated.
What to do: HPE has not stated a fixed version or workaround for CVE-2026-79852. Restrict access to the AOS web management interface until HPE publishes a fix.
| Product | Affected |
|---|---|
| HPE AOS | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Weakness
- CWE-89
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H