CVE-2026-44866

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-448678.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation CVE-2026-448688.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation CVE-2026-448698.8Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation CVE-2026-44878.8A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. CVE-2026-448708.8Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operat CVE-2026-448718.8Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operat CVE-2026-448727.2A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitatio CVE-2026-448735.4A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administ CVE-2026-448744.9A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to acces CVE-2026-448776.5An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successfu CVE-2026-448787.2A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to ac CVE-2026-448797.2A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform comm