CVE-2026-79858

Summary

An unauthenticated SQL injection flaw in the PAPI protocol of AOS-8 allows remote attackers to read and alter database contents without credentials, risking data theft, manipulation, and service disruption.

Exploitability

Exploitation is straightforward for remote attackers due to lack of authentication and low complexity, requiring only network access to the vulnerable PAPI endpoint.

Blast radius

Successful exploitation could lead to full compromise of backend databases, enabling credential theft, privilege escalation, and denial of service via database corruption or overload.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to AOS-8 version 2.590 or later, as this is the fixed version specified in the vendor advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.