CVE-2026-44868
published 2026-05-12CVE-2026-44868: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these…
PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.90%
55.0th percentile
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.10.0.0 – 8.10.0.21 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.12.0.0 – 8.12.0.6 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 8.13.0.0 – 8.13.1.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.8.0.0 Web-based Management Interface command injection
vuldb·2026-05-12
CVE-2026-44868 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.8.0.0 Web-based Management Interface command injection
A vulnerability classified as critical was found in HPE Aruba Networking Wireless Operating System up to 10.8.0.0. Affected by this issue is some unknown functionality of the component Web-based Management Interface. The manipulation results in command injection.
This vulnerability is reported as CVE-2026-44868. The attack can be launched remotely. No exploit exists.
GHSA
GHSA-6999-crm6-63wv: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems
ghsa_unreviewed·2026-05-12
CVE-2026-44868 [HIGH] GHSA-6999-crm6-63wv: Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems
Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published