CVE-2026-44868

Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10

View on CVE.org
Published May 12, 2026 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Description
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Analysis

AI-generated

Technical impact

Command injection vulnerabilities in the web‑based management interface of HPE Aruba AOS‑8 and AOS‑10 allow an authenticated remote attacker to execute arbitrary operating‑system commands. This flaw can be used to compromise the host, elevate privileges, exfiltrate data or launch further attacks once the attacker gains access credentials to the web interface.

Affected Systems

Hewlett Packard Enterprise Aruba Networking Wireless Operating System (AOS) versions 8 and 10 are affected. No specific firmware revisions are listed, but any system running AOS‑8 or AOS‑10 remains vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity vulnerability that can provide an attacker with full control over the affected device. The exploit probability is not quantified (EPSS not available) and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote via the web interface, requiring authentication; an attacker with valid administrative credentials can trigger the command injection and run arbitrary commands on the device’s operating system.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest HPE Aruba AOS firmware release that contains the patch for command injection.
  • Restrict administrative access to the web interface by limiting it to trusted IP ranges or VPN tunnels and enforce multi‑factor authentication for portal users.
  • Configure local host‑based firewalls or segmentation to block or monitor suspicious command execution patterns and routinely review system logs for anomalous activity.

Generated by OpenCVE AI on May 12, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Arubanetworks
Arubanetworks arubaos
Arubanetworks sd-wan
CPEs cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
Vendors & Products Arubanetworks
Arubanetworks arubaos
Arubanetworks sd-wan
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Hpe
Hpe arubaos
Vendors & Products Hpe
Hpe arubaos
Type Values Removed Values Added
Weaknesses CWE-77
Type Values Removed Values Added
Description Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
Title Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
hpe
Published
Updated
May 14, 2026, 12:28 PM
Reserved
May 7, 2026, 9:29 PM

View source JSON

Updated
May 14, 2026, 12:28 PM

JSON

Status
Analyzed
Published
May 12, 2026, 8:16 PM
Modified
Oct 26, 2026, 5:10 PM

View source JSON

No data.

Updated
May 13, 2026, 10:36 AM

JSON