CVE-2026-79854 is a critical SQL injection vulnerability in HPE Networking ArubaOS AOS-10. It is remotely reachable without authentication, and successful exploitation can execute arbitrary commands on the underlying operating system. The fixed releases cover three active branches, but the advisory also warns that products past end of maintenance should be presumed affected unless HPE states otherwise.
That warning matters for organizations that keep wireless controllers and gateways in service beyond their planned replacement date. A device may still perform its operational role while receiving less frequent software attention. A critical management-plane vulnerability can expose the organization to a risk that is not visible in a simple availability report.
The affected AOS-10 ranges are 10.8.0.0 through 10.8.1.1, 10.7.0.0 through 10.7.2.6, and 10.4.0.0 through 10.4.1.13. Fixed builds are 10.8.1.2, 10.7.2.7, and 10.4.1.14. HPE's scope includes Mobility Conductors, Mobility Controllers, Mobility Gateways managed by Central, and AOS-10 access points, with the exact impact depending on the affected product and interface.
Separate support state from network state
A system without a current vendor support path is not automatically exposed to the internet. It may sit behind strong segmentation and a controlled jump host. The operating question is whether the organization can prove those controls and whether it has a credible plan to replace the vulnerable software.
For each older system, record the model, active branch, last supported patch, maintenance status, management address, firewall path, and owner. Mark the device as at-risk if the vendor cannot provide a fixed build or if the current build remains in an affected range. A temporary management restriction can reduce reachability, but it does not restore vendor support.
Plan replacement with an interim control
HPE recommends limiting CLI and web management to a dedicated Layer 2 segment or VLAN and applying Layer 3 firewall policy. Use that recommendation as a baseline while replacement or migration is planned. The restriction should be tested from an unapproved source and after HA failover.
A hardware replacement can take longer than a patch cycle. In the meantime, teams should inventory the management path, review local accounts, preserve logs, and monitor for configuration changes or unexpected outbound traffic. Those actions are not evidence that exploitation occurred. They are preparation for detecting or containing it.
Avoid false comfort from external counts
A ZoomEye Search for app="ArubaOS" returned 212 product-fingerprint matches during this review. The separate CVE Filter returned zero. The larger count is 212, but it represents broad product fingerprint visibility. It is not a count of vulnerable devices and does not say which branch or management path each observation belongs to.
An organization can use external observations as one input for identifying forgotten public-facing systems. The internal record still needs the authenticated software version, support state, and network policy. For older equipment, that record may be incomplete because the system is outside normal management workflows.
Escalate when replacement is not realistic
The CVSS 3.1 score is 9.8, and the attack path requires no credentials. If replacement cannot be completed on the expected schedule, the risk owner should document the compensating controls, monitoring coverage, residual exposure, and decision date. A quarterly review is not enough if the management path changes or a new exploitation report appears.
CVE-2026-79854 is a reminder that lifecycle risk is part of vulnerability management. A supported fixed build removes the known software issue. A verified management boundary reduces the chance of reach while that work is underway. Organizations need both records to understand the remaining risk.