ArubaOS web management interface SQL injection allows privilege escalation
A SQL injection flaw in ArubaOS's web-based management interface lets an unauthenticated remote attacker access privileged internal functionality and gain operator privileges.
- Vendor
- HPE
- Product
- ArubaOS (AOS)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-79852 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-79852 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-24 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 23, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-24. Full cross-catalog view: /kev-comparison
CVE-2026-79852 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-79852 is a SQL injection vulnerability in the web-based management interface of Aruba Operating System (AOS). An unauthenticated remote attacker who can reach the management interface can send crafted requests to access privileged internal functionality and elevate to operator privileges without authentication.
The flaw affects both AOS-8 and AOS-10 branches and is addressed in the fixed versions listed in HPE’s security bulletin. HPE’s bulletin covers 72 total CVEs in this advisory, including eight classified at maximum severity for authentication bypass and unauthenticated remote code execution; CVE-2026-79852 is rated separately at CVSS 9.8.
Mitigation: Restrict web management interface access to dedicated, firewalled network segments. Apply the patched AOS version per the HPE advisory. HPE states it is not aware of active exploitation as of the release date.
