CVE-2026-79852
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Risk Assessment
An unauthenticated attacker can use SQL injection in the web interface to execute arbitrary commands, risking full device takeover.
Recommendation
Install the available AOS updates as soon as possible and restrict access to the web-based management interface from untrusted networks.
Other vulnerabilities in AOS
See all- CVE-2026-79872Critical
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- CVE-2026-95717Medium
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS. An authenticated remote attacker with high privileges could inject malicious scripts. Successful exploitation could execute arbitrary script code in the context of another authenticated user's browser session.
Original NVD description (English source)
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS