HPE AOS-10: Unauthenticated SQL injection leading to remote code execution
Summary
HPE ArubaOS 10 (AOS-10), the operating system of Mobility Conductors, Mobility Controllers, Mobility Gateways and AOS-10 access points, contains an unauthenticated SQL injection flaw in an affected interface. A remote attacker without credentials and without user interaction can inject SQL and, according to HPE, execute arbitrary commands on the underlying operating system. The CVSS score is 9.8 (critical). The vulnerability is in the management interface, so exposure from user, guest or internet-facing networks is the main risk.
Affected
- AOS-10.8.x up to 10.8.1.1
- AOS-10.7.x up to 10.7.2.6
- AOS-10.4.x up to 10.4.1.13
- Other branches (for example 10.5, 10.6, 10.3): Unknown. Check the HPE advisory.
Fixed in
- AOS-10.8.x: 10.8.1.2 and later
- AOS-10.7.x: 10.7.2.7 and later
- AOS-10.4.x: 10.4.1.14 and later
Workaround
For releases without a fix, HPE recommends limiting access to the CLI and web management interfaces:
- Place management interfaces in a dedicated layer 2 segment or VLAN
- Apply firewall policies at layer 3 and above
- Enable accounting to log user activity
Exploitation
- HPE states it knows of no exploitation of these vulnerabilities.
- HPE states it knows of no public exploit code. No public PoC from security researchers was found.
- Not in the CISA KEV catalogue as of 24 October 2026. Re-check, as this can change quickly.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
Our recommendation
- Treat as urgent. Inventory all AOS-10 devices and their versions.
- Upgrade to a fixed build. Plan a maintenance window, as access points reboot during upgrades.
- Until patched, restrict management interfaces to a dedicated management VLAN and block access from user, guest and WAN networks.
- Check whether any management interface responds from user, guest or internet-facing networks.
- Monitor logs for unusual access to management interfaces and re-check the KEV catalogue.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HPE Security Bulletin HPESBNW05162 support.hpe.com
- CCB Belgium advisory on HPE Networking AOS ccb.belgium.be
- VulDB record CVE-2026-79854 vuldb.com
- CyberExperts: Aruba AOS wireless patches cyberexperts.com
- Carthage Electronics CVE threat brief carthageelectronics.com
- Rescana: HPE Aruba AOS critical CVEs www.rescana.com
- Cybaverse: HPE Aruba AOS critical flaws www.cybaverse.co.uk
- HPE CSAF advisory hpesbnw05026 csaf.arubanetworking.hpe.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:58.
Original description (NVD)
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.