{"id":"CVE-2026-79852","published":"2026-10-22T19:17:57.410","lastModified":"2026-10-26T14:18:54.933","description":"A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The AOS web-based management interface contains an SQL injection vulnerability (CWE-89) that allows unauthenticated remote attackers to inject malicious SQL queries, potentially leading to arbitrary command execution on the underlying OS.","exploitability":"Exploitation is straightforward for remote attackers due to lack of authentication requirements and low attack complexity.","blast_radius":"Successful exploitation could result in full system compromise including confidentiality, integrity, and availability impacts across the AOS instance and potentially connected infrastructure.","remediation":"Upgrade to AOS version 2.590 or later, as this is the fixed version that addresses CVE-2026-79852.","detection":"Look for SQL injection patterns in HTTP request parameters targeting the web-based management interface, such as single quotes, UNION SELECT statements, or time-based blind payloads (e.g., SLEEP(), BENCHMARK()) in access logs or WAF alerts.","tags":["sql-injection","rce","web-interface","unauthenticated","os-command-execution"],"model":"garnet-coder","analyzedAt":"2026-10-26T08:43:25.045Z"}}