CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

HPE Networking AOS-8/AOS-10 (HPESBNW05162): Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 (CVSS 3.1 10.0); fixed 2026-10-22

cve · CVE-2026-79848 single-source

Coverage
1
first 2026-10-23 → last 2026-10-23
Latest activity
2026-10-23
HPE's Aruba wireless bulletin fixes 19 unauthenticated network flaws at CVSS 9.0+; HPE knows of no public…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-79848, newest first. Check the date before acting on an older one.

  • Upgrade every HPE Networking (Aruba) Mobility Conductor, Controller, Gateway and access point on AOS-10 or AOS-8 to the fixed build of its train (10.8.1.2, 10.7.2.7, 10.4.1.14, 8.13.3.1 or 8.10.0.24), and until then confine the CLI and web management interfaces to a dedicated layer 2 segment or VLAN behind firewall policy, as HPE advises.
    2026-10-23CVE-2026-79844 +18

Defender insights

What each entry about CVE-2026-79848 tells a defender to do, newest first.

2026-10-23NOTABLEHPE's Aruba wireless bulletin fixes 19 unauthenticated network flaws at CVSS 9.0+; HPE knows of no public exploit code

Exposure · detection

Story timeline

  1. 2026-10-23HPESBNW05162, HPE Networking (Aruba) AOS-8 and AOS-10 wireless: 72 CVEs fixed in one bulletin, 19 of them unauthenticated and network-reachable at CVSS 9.0 or above, across controllers, gateways and access points
    trending-vulnerabilitiesHPE's Aruba wireless bulletin fixes 19 unauthenticated network flaws at CVSS 9.0+; HPE knows of no public exploit code

Hunting pivots

Affected products
HPE Networking AOS-10HPE Networking AOS-8
Tags
auth-bypasspatch-availablepre-authrcesqlivulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Lateral MovementExploitation of Remote Services

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-23/hpesbnw05162-hpe-aruba-aos-8-aos-10-72-cves-19-unauth · ATT&CK page ↗

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-10-23/hpesbnw05162-hpe-aruba-aos-8-aos-10-72-cves-19-unauth · ATT&CK page ↗

Entries about HPE Networking AOS-8/AOS-10 (HPESBNW05162): Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 (CVSS 3.1 10.0); fixed 2026-10-22 (1)

2026-10-23 · view entry permalink →

NOTABLECVE-2026-79844 +18NATOA2

HPESBNW05162, HPE Networking (Aruba) AOS-8 and AOS-10 wireless: 72 CVEs fixed in one bulletin, 19 of them unauthenticated and network-reachable at CVSS 9.0 or above, across controllers, gateways and access points

HPE Networking's bulletin HPESBNW05162 (initial release 2026-10-22) fixes 72 CVEs in the wireless operating systems AOS-8 and AOS-10 for Mobility Conductors, Controllers, Gateways managed by HPE Networking Central, AOS-10 access points (AOS-AP) and AOS-8 Instant access points (AOS-IAP) (HPE Networking, 2026-10-22). By the CSAF's CVSS 3.1 scores, 34 of the 72 rate 9.0 or higher (eight at 10.0, ten at 9.8, eleven at 9.6, one at 9.4 and four at 9.3); the 19 rated 10.0, 9.8 or 9.4 need network access and no privileges, and the other 15 are reachable from the adjacent network (HPE Networking CSAF, 2026-10-22). The named mechanisms include authentication bypasses and command injection in the AOS-10 interface and in the PAPI protocol, a buffer overflow and a command injection in the AOS-8 PAPI protocol that arrive as crafted packets on its UDP port, an authentication bypass in the AOS-8 SSH daemon, and SQL injection in the web-based management interface (HPE Networking CSAF, 2026-10-22). HPE says the flaws were generally found by its internal security research, that it is not aware of public discussion or exploit code as of the release, and that customers are strongly urged to patch; for some of the critical rows exploitation also needs preconditions outside the attacker's control, which the bulletin does not itemise (HPE Networking, 2026-10-22)(HPE Networking CSAF, 2026-10-22).

The bulletin text names AOS-10 10.8.x up to 10.8.1.1, 10.7.x up to 10.7.2.6 and 10.4.x up to 10.4.1.13, and AOS-8 8.13.x up to 8.13.3.0 and 8.10.x up to 8.10.0.23, while the machine-readable CSAF lists wider known-affected ranges, AOS-10 10.8.0.0 to 10.8.1.1, 10.6.0.0 to 10.7.2.6 and 10.3.0.0 to 10.4.1.13, and AOS-8 8.12.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23, which take in the 10.6, 10.3 and 8.12 branches the text omits, so treat the CSAF ranges as the scope; fixed builds are AOS-10.8.1.2, 10.7.2.7 and 10.4.1.14 and AOS-8.13.3.1 and 8.10.0.24 (HPE Networking, 2026-10-22)(HPE Networking CSAF, 2026-10-22). HPE's workaround is to restrict the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN, controlled by firewall policies at layer 3 and above with accounting controls (HPE Networking, 2026-10-22).

Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met.

HPE Networking (CSAF for HPESBNW05162) 2026-10-22
vulnerability23 Oct 03:36Zsingle-sourceOpen finding →
Sources: HPE Networking (security bulletin HPESBNW05162 rev. 1) · HPE Networking (CSAF for HPESBNW05162)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • csaf.arubanetworking.hpe.com1 (50%)
  • support.hpe.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)