CVE-2026-44860
published 2026-05-12CVE-2026-44860: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management…
PriorityP352high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.32%
23.2th percentile
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.10.0.0 – 8.10.0.21 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.12.0.0 – 8.12.0.6 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.13.0.0 – 8.13.1.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9r55-7fpw-rrpv: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
ghsa_unreviewed·2026-05-12
CVE-2026-44860 [HIGH] CWE-89 GHSA-9r55-7fpw-rrpv: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
vuldb·2026-05-12
CVE-2026-44860 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
A vulnerability was found in HPE Aruba Networking Wireless Operating System up to 10.8.0.0. It has been declared as critical. The impacted element is an unknown function. The manipulation results in sql injection.
This vulnerability was named CVE-2026-44860. The attack may be performed from remote. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published