CVE-2026-44867
published 2026-05-12CVE-2026-44867: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.90%
55.0th percentile
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.10.0.0 – 8.10.0.21 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.12.0.0 – 8.12.0.6 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.13.0.0 – 8.13.1.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.8.0.0 Web-based Management Interface command injection
vuldb·2026-05-12
CVE-2026-44867 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.8.0.0 Web-based Management Interface command injection
A vulnerability classified as critical has been found in HPE Aruba Networking Wireless Operating System up to 10.8.0.0. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. The manipulation leads to command injection.
This vulnerability is documented as CVE-2026-44867. The attack can be initiated remotely. There is not any exploit available.
GHSA
GHSA-f86v-9v45-85xf: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems
ghsa_unreviewed·2026-05-12
CVE-2026-44867 [HIGH] GHSA-f86v-9v45-85xf: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published