HPE Aruba AOS CVE-2026-44853

Exploitation requires authenticated access to the AOS web-based management interface at a HIGH privilege level (CVSS PR:H) - the attacker must already be a privileged/administrative operator of the controller or gateway, so this is not exploitable by anonymous or low-privilege users. The concrete prerequisite is reachability of the AOS management interface plus valid high-privilege management credentials on a device running one of the affected 8.10/8.12/8.13 or 10.4/10.7/10.8 builds. Limiting factors that reduce real-world risk: the PR:H requirement, the common practice of isolating the Aruba management plane on a segmented/out-of-band network (which undercuts the AV:N assumption), and CISA SSVC marking exploitation as none and not automatable.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but critically gated by PR:H, meaning the attacker must already hold high/administrative privileges on the management interface, which sharply limits the realistic attacker population. Corroborating signals point to low near-term risk: EPSS is 0.26% (49th percentile), and CISA's SSVC decision framework records Exploitation: none and Automatable: no, while acknowledging Technical Impact: total. The PR:H requirement and the non-automatable, no-known-exploitation status make this a patch-on-normal-cycle item for most defenders rather than an emergency, but the 'total' technical impact means that in environments where management-plane credentials are shared, weak, or exposed, a compromised or malicious operator can fully take over the device. Note the tension worth verifying: the vector is AV:N yet best practice (and typical Aruba deployments) restrict the management interface to an isolated network - if your management plane is genuinely segmented, practical remote reachability is lower than AV:N implies.

An attacker who has obtained privileged administrator credentials for an Aruba controller's web management interface (via credential reuse, phishing, or an insider) reaches the management endpoint over the network and submits a crafted request that injects OS commands or writes an arbitrary file to the device. The uploaded file is then executed in a privileged context, giving the attacker full command execution on the controller. No public exploit code is identified at time of analysis, and CVSS AC:L indicates the exploit itself is technically straightforward once the privilege prerequisite is met.