CVE-2026-79858
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8
- Risk score
- 70/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8, allowing an attacker to obtain and modify sensitive information and interrupt service operation.
- Affected
- {'products': ['AOS-8'], 'packages': [], 'versions': []}
- Fix
- Check the linked advisory for details on the fix.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.
Last activity 22 Oct 2026. Patch Forecast updates every hour.