What is the CVSS score of CVE-2026-44855?

CVE-2026-44855 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Hpe Aruba Networking Wireless Operating System Aos are affected by CVE-2026-44855?

HPE Aruba Networking AOS-8 and AOS-10 wireless controllers contain a privilege escalation vulnerability (CVE-2026-44855) that allows authenticated administrative users to execute arbitrary code with…

How to fix or mitigate CVE-2026-44855?

Within 24 hours, inventory all AOS-8 and AOS-10 deployments in your environment and document all personnel with administrative CLI access; immediately restrict CLI administrative privileges to essential personnel only and enable multi-factor authentication if your AOS version supports it. Within 7 days, audit access logs from the past 30 days for any unusual administrative CLI activity, implement enhanced alerting on all administrative CLI commands across your controllers and gateways, and document findings. Within 30 days, continue monitoring HPE security advisories for patch availability; implement network segmentation to limit lateral movement if a controller is compromised; and evaluate whether upgrading to newer AOS versions is feasible if patches are released.

Hpe Aruba Networking Wireless Operating System Aos CVE-2026-44855

EUVD-2026-29805 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-12 hpe

GHSA-ffvh-r779-7j7g

RCE Buffer Overflow Stack Overflow Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:56 vuln.today

CVE Published

May 12, 2026 - 18:59 nvd

HIGH 7.2

DescriptionCVE.org

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

AnalysisAI

Authenticated arbitrary code execution in HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems lets an attacker with administrative CLI privileges run code with elevated OS-level privileges via stack-based buffer overflows in several backend management service components. An administrator sending specially crafted requests through the command-line interface can escape the managed CLI context and gain control of the underlying operating system of the controller or gateway. There is no public exploit identified at time of analysis, EPSS probability is very low (0.07%), and CISA SSVC records no known exploitation.