For CVE-2026-79848, a change ticket marked complete is weaker evidence than an authenticated device record showing a fixed AOS-8 release. The vulnerability is an unauthenticated SQL injection that HPE says can lead to arbitrary command execution on the underlying operating system, with a CVSS 3.1 score of 10.0.
Start with the required proof
The evidence set should answer five questions: which device was changed, which role it serves, which vulnerable range it was in, which fixed release it now runs, and who confirmed the result. The affected ranges are 8.13.0.0 through 8.13.3.0 and 8.10.0.0 through 8.10.0.23. The vendor-listed fixes are 8.13.3.1 and 8.10.0.24.
Retain a timestamped version check and the device identity together. A screenshot without a hostname, management address, or configuration context can be difficult to reconcile later. Include conductors, controllers, gateways, and Instant Access Points because HPE's advisory covers all of those roles.
Test the operational outcome
Version verification is necessary but not sufficient. Confirm that management access works for approved operators, access points join as expected, gateway functions remain available, and monitoring still receives the required records. Where the deployment uses redundancy, verify that failover behavior remains within the approved design.
Review the accounting and logging controls after the upgrade. HPE recommends accounting controls that track user activity and resource usage. A post-change review should show that relevant events still arrive, retain accurate time, and can be queried by the response team.
Verify the interim control
If any device remains on an affected build, verify the compensating restriction on command-line and web-based management interfaces. HPE recommends a dedicated Layer 2 segment or VLAN plus firewall policy at Layer 3 and above. Test actual reachability from disallowed networks and record the result.
Do not confuse the external picture with internal completion. ZoomEye's app="ArubaOS" query returned 212 product fingerprint matches during this review. That count can describe product-identifiable assets, but it does not show firmware state or confirm vulnerable devices.
Record uncertainty
The vendor advisory does not disclose the exact interface, SQL query, database engine, or exploitation sequence. CISA Vulnrichment marks the CVE as Automatable: yes and Exploitation: none at the recorded time, while HPE says it was not aware of public exploit code at release. Verification records should distinguish observed device state from external risk assessments.
Close the loop
Publish a final count by role and branch. Separate fixed, affected, unavailable, and retired devices. Link each exception to compensating controls and an expiration date. Preserve the evidence in a location that does not depend on the affected management plane alone. The result is not just an upgrade report. It is a defensible statement of which assets remain exposed and what evidence supports the answer.