CVE-2026-79858

critical · 9.8

An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.

9.8

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2026-10-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05162en_us&docLocale=en_US

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-79858