CVE-2026-44854

HighCVSS 7.2/10Last modified Oct 26, 2026

Description

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files to the underlying operating system, potentially leading to remote code execution as a privileged user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE Aruba Networking Wireless Operating System (AOS)>= 8.13.0.0, <= 8.13.1.1; >= 8.12.0.0, <= 8.12.0.6; >= 8.10.0.0, <= 8.10.0.21; 10.8.0.0; >= 10.7.0.0, <= 10.7.2.2; >= 10.4.0.0, <= 10.4.1.10

References

Timeline

Published
May 12, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-448557.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448567.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448577.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448587.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-448597.2Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line inteCVE-2026-44868.8A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/formEasySetPassword of tCVE-2026-448607.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448617.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448627.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448637.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448647.2SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface CVE-2026-448657.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation
CVE-2026-44854: High severity, CVSS 7.2 | Vulnix