CVE-2026-44861
published 2026-05-12CVE-2026-44861: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management…
PriorityP352high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.32%
23.2th percentile
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.10.0.0 – 8.10.0.21 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.12.0.0 – 8.12.0.6 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.13.0.0 – 8.13.1.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8xm6-v26m-8mrc: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
ghsa_unreviewed·2026-05-12
CVE-2026-44861 [HIGH] CWE-89 GHSA-8xm6-v26m-8mrc: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
vuldb·2026-05-12
CVE-2026-44861 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
A vulnerability was found in HPE Aruba Networking Wireless Operating System up to 10.8.0.0. It has been rated as critical. This affects an unknown function. This manipulation causes sql injection.
The identification of this vulnerability is CVE-2026-44861. It is possible to initiate the attack remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published