HPE patches Aruba AOS-8 SSH authentication bypass and dozens of other flaws
Bulletin HPESBNW05162 covers 72 AOS-8 and AOS-10 flaws, several scored CVSS 10.0 for unauthenticated remote code execution.
72
CVE-2026-79858
Unauthenticated SQL injection in HPE Aruba AOS-8 PAPI
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An unauthenticated SQL injection flaw exists in the PAPI protocol in HPE Aruba AOS-8. A remote attacker can trigger it over the network with no login and no user interaction. Successful exploitation can let the attacker read and change sensitive data in the underlying database and interrupt the affected service. AOS-8 deployments that expose PAPI are affected; affected builds are not listed.
What to do: Apply HPE's update for CVE-2026-79858. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| HPE Aruba AOS-8 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H