Command injection in HPE Aruba Networking EdgeConnect SD-WAN Gateways CLI (CVE-2026-44879)

A command injection vulnerability in the CLI of HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS allows a highly privileged, authenticated remote attacker to inject arbitrary commands via certain CLI operations. Successful exploitation enables execution of arbitrary commands on the underlying operating system. Affected versions: - ECOS 9.4.x.x: 9.4.6.x and below - ECOS 9.5.x.x: 9.5.6.x and below - ECOS 9.6.x.x: 9.6.1.x and below We recommend updating to: ECOS 9.4.7.0 and above, ECOS 9.5.7.0 and above, ECOS 9.6.2.0 and above, ECOS 9.7.0.0 and above, ECOS 9.4.5.0 (all builds) and above, ECOS 9.5.5.0 (all builds) and above, ECOS 9.6.0.0 (all builds) and above. CVSS 7.2 · our assessment: this_week Reference: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US Details: https://vuln.today/cve/CVE-2026-44879