CVE-2026-44863
published 2026-05-12CVE-2026-44863: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management…
PriorityP352high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.32%
23.2th percentile
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.10.0.0 – 8.10.0.21 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.12.0.0 – 8.12.0.6 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.13.0.0 – 8.13.1.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
vuldb·2026-05-12
CVE-2026-44863 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
A vulnerability identified as critical has been detected in HPE Aruba Networking Wireless Operating System up to 10.8.0.0. Affected is an unknown function. Performing a manipulation results in sql injection.
This vulnerability is identified as CVE-2026-44863. The attack can be initiated remotely. There is not any exploit available.
GHSA
GHSA-3q8r-gjx2-h6v2: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
ghsa_unreviewed·2026-05-12
CVE-2026-44863 [HIGH] CWE-89 GHSA-3q8r-gjx2-h6v2: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published