CVE-2026-79852 is an unauthenticated SQL-injection flaw in the web-based management interface for HPE Aruba Networking’s ArubaOS. HPE says a remote attacker can exploit it to execute arbitrary commands on the underlying operating system—turning a management-plane bug into potential control of the network appliance itself.
ArubaOS, also called HPE Aruba Networking Wireless Operating System, runs enterprise Wi-Fi infrastructure: mobility conductors and controllers, gateways, and access points. It is the software teams use to centrally configure and operate wireless networks across small offices, branches, campuses and remote-worker deployments. That puts the issue in reach of organisations with managed business or institutional Wi-Fi, especially those operating many locations; the advisory does not single out industry sectors.
A web request can cross into the appliance OS
SQL injection means an application passes attacker-controlled input into a database query without safely separating data from SQL instructions. In this case, the exposed component is ArubaOS’s web management interface, and the attacker needs no account or prior authentication. They do need network reachability to that interface; this is not a claim that every ArubaOS device is reachable from the public internet.
The vendor’s advisory does not identify the affected endpoint, the unsafely handled parameter, database operation, or the mechanism that converts injection into command execution. Those details matter for detection engineering, but they have not been publicly confirmed. HPE tracks the issue as VULN-582 and credits researcher moonv through its bug-bounty program.
This was part of HPE’s October 22 bulletin covering 72 CVEs across AOS-8 and AOS-10. That larger release includes, among others, CVE-2026-79844 and CVE-2026-79853; neither changes the specific exposure or remediation path for CVE-2026-79852.
Fixed firmware is available now
HPE’s current machine-readable advisory lists these affected ranges and fixes:
AOS-10 10.8.0.0 through 10.8.1.1: upgrade to 10.8.1.2.
AOS-10 10.7.0.0 through 10.7.2.6: upgrade to 10.7.2.7.
AOS-10 10.4.0.0 through 10.4.1.13: upgrade to 10.4.1.14.
AOS-8 8.13.0.0 through 8.13.3.0: upgrade to 8.13.3.1.
AOS-8 8.10.0.0 through 8.10.0.23: upgrade to 8.10.0.24.
Inventory physical appliances and virtual deployments, not just controllers: the affected roles include mobility conductors, controllers, gateways and access points capable of running those releases. HPE presumes End-of-Maintenance releases are affected unless explicitly stated otherwise, while End-of-Support installations have not been assessed and should be treated as potentially affected.
If an upgrade must wait, remove web and CLI administration from ordinary user networks. Put management on a dedicated layer-2 segment or VLAN, enforce layer-3 firewall policy around it, and review accounting records for unexpected administrative activity or resource use. Segmentation is a compensating control, not a patch.
No observed exploitation, but little attacker effort is needed
As of October 29, no confirmed exploitation in the wild or incident tied to CVE-2026-79852 could be confirmed. It is not listed in CISA’s Known Exploited Vulnerabilities catalogue, and no public proof of concept or exploit code has surfaced. That is absence of public evidence, not evidence that private exploit code does not exist.
For network teams, the practical priority is simple: identify the running branch, schedule the matching fixed firmware, and make sure management interfaces are reachable only from dedicated admin paths. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which can help keep appliance firmware findings from disappearing into a broad vendor bulletin.
