CVE-2026-44864
published 2026-05-12CVE-2026-44864: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management…
PriorityP352high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
0.32%
23.2th percentile
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.10.0.0 – 8.10.0.21 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.12.0.0 – 8.12.0.6 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.13.0.0 – 8.13.1.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
vuldb·2026-05-12
CVE-2026-44864 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.8.0.0 sql injection
A vulnerability labeled as critical has been found in HPE Aruba Networking Wireless Operating System up to 10.8.0.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to sql injection.
This vulnerability is tracked as CVE-2026-44864. The attack can be launched remotely. No exploit exists.
GHSA
GHSA-9xv7-mm2m-gv6c: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
ghsa_unreviewed·2026-05-12
CVE-2026-44864 [HIGH] CWE-89 GHSA-9xv7-mm2m-gv6c: SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and manage
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published