CVE-2026-44870

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Hewlett Packard Enterprise (HPE)	HPE Aruba Networking Wireless Operating System (AOS)	>= 8.13.0.0, <= 8.13.1.1; >= 8.12.0.0, <= 8.12.0.6; >= 8.10.0.0, <= 8.10.0.21; >= 10.7.0.0, <= 10.7.2.2; 10.8.0.0; >= 10.4.0.0, <= 10.4.1.10

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_USVendor Advisory

Timeline

Published: May 12, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-448718.8Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operat CVE-2026-448727.2A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitatio CVE-2026-448735.4A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administ CVE-2026-448744.9A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to acces CVE-2026-448757.8In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows ele CVE-2026-448776.5An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successfu CVE-2026-448787.2A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to ac CVE-2026-448797.2A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform comm CVE-2026-44888.8A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected is the function strcpy of the file /goform/setSysAdm.CVE-2026-448808.8A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could al CVE-2026-448819.9Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448828.1Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa