AOS-8 upgrade paths for CVE-2026-79849: 8.10 versus 8.13

The CVE-2026-79849 remediation requires a choice between the 8.10 and 8.13 branches based on the current release and the device's role in the wireless architecture. HPE identifies separate fixed versions for each branch, and those versions sit in different maintenance trains.

The vulnerability is an unauthenticated SQL injection in an affected AOS-8 interface. HPE says successful exploitation could execute arbitrary commands on the underlying operating system. The CVE has a CVSS 3.1 base score of 10.0, so delaying an affected management plane without a compensating control requires a clear risk decision.

Affected and fixed versions

The CVE record lists two affected ranges: 8.10.0.0 through 8.10.0.23 and 8.13.0.0 through 8.13.3.0. HPE's advisory lists 8.10.0.24 and above as the fixed release for the 8.10 branch. For 8.13, the fixed release is 8.13.3.1 and above.

Device scope includes Mobility Conductors, Mobility Controllers, Mobility Gateways managed by HPE Networking Central, and AOS-8 Instant Access Points where the applicable software is installed. The broader bulletin also covers AOS-10 issues, but CVE-2026-79849 is specifically described as an AOS-8 SQL injection issue.

HPE says versions past end of maintenance are presumed affected unless the vendor states otherwise. Deployments beyond end of support have not been assessed and should be considered potentially impacted. A branch that is no longer receiving fixes needs an architecture or lifecycle decision, not an upgrade date alone.

Why cross-branch moves need review

Moving from 8.10 to 8.13 is more than applying a patch inside one train. It changes the release family and may affect controller behavior, access point adoption, gateway registration, clustering, management integrations, and hardware support. A smooth 8.10 patch inside the same branch is not automatically proof that an 8.13 migration is low risk.

Build a matrix that maps each device to its current branch, target release, hardware model, role, and dependencies. Mark devices that participate in high availability or cluster relationships so the upgrade order can preserve service. Include access points that need compatible controller software and any integration that depends on a specific management API.

Review the device's saved or standby image before the maintenance window. Confirm that the target release is supported on the hardware and that the required boot image is available. A release note that describes the fixed software is not enough if the device cannot boot or adopt its access points after the change.

Pre-upgrade evidence

Capture the running configuration and a current support bundle if local policy permits. Record the active and standby images, uptime, cluster state, high availability role, access point count, and management access rules. Preserve the vendor advisory and the change approval with the device record.

Check management plane exposure separately from software version. HPE recommends restricting the CLI and web-based management interfaces to a dedicated layer 2 segment or VLAN and using firewall policy at layer 3 and above with accounting. If an affected device is exposed to untrusted networks, that condition should influence the maintenance order.

ZoomEye can provide a limited external check. app="ArubaOS" returned 212 product fingerprint matches during this review, and vul.cve="CVE-2026-79849" returned 0. Neither result changes the vendor version matrix. They help identify whether any owned management address appears in global observations.

Post-upgrade verification

Verify the active image after the reboot. Confirm that the expected fixed version is running on every node, including the second high availability peer. Check high availability state, access point adoption, gateway health, and management connectivity from approved sources. Test that management access from user, guest, or external networks remains blocked where policy requires it.

Retain the upgrade log, post-change version output, configuration backup reference, and access test results. If a device could not be upgraded, document the compensating control, risk owner, and next date. CVE-2026-79849 remains a confirmed issue until the fixed release is active or the affected system is retired.

References

• HPE Networking CSAF advisory HPESBNW05162: https://csaf.arubanetworking.hpe.com/2026/hpe_networking_-_hpesbnw05162.txt
• HPE support bulletin: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US
• CVE-2026-79849 record view: https://vulnerability.circl.lu/vuln/CVE-2026-79849
• CERT-FR advisory CERTFR-2026-AVI-1369: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1369/
• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-79849