What is the CVSS score of CVE-2026-44858?

CVE-2026-44858 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Aruba AOS are affected by CVE-2026-44858?

HPE Aruba Wireless Operating Systems (AOS-8 and AOS-10) contain a remote code execution vulnerability exploitable by administrative users, transforming trusted access into a potential attack vector…

How to fix or mitigate CVE-2026-44858?

Within 24 hours, audit all accounts with AOS-8/AOS-10 administrative access, enforce multi-factor authentication for all administrative sessions, and review administrative command execution logs for anomalies. Within 7 days, implement network segmentation isolating management interfaces on dedicated VLANs, deploy access control lists restricting administrative connectivity to defined source IP addresses, and enable comprehensive logging of all management service activity. Within 30 days, monitor HPE Aruba security advisories for patches to AOS-8 and AOS-10, establish criteria for hardware refresh or operating system upgrade if vendor patches remain unavailable after 90 days, and conduct red-team exercises validating the effectiveness of administrative access controls.

Aruba AOS CVE-2026-44858

EUVD-2026-29808 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-12 hpe

GHSA-rx7m-4wrr-jxxp

RCE Buffer Overflow Stack Overflow Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Requires existing admin privileges (PR:H) but reachable over the network CLI with low complexity, yielding full OS code execution, so C/I/A all High and scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:54 vuln.today

CVE Published

May 12, 2026 - 19:03 nvd

HIGH 7.2

DescriptionCVE.org

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending specially crafted requests to the affected services. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the underlying operating system.

AnalysisAI

Privilege-to-OS remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10), where several CLI-accessible management service components contain stack-based buffer overflows (CWE-121). An authenticated administrator can send specially crafted requests to these services to execute arbitrary code with elevated privileges on the underlying OS, escaping the constrained management context. There is no public exploit identified at time of analysis, EPSS is very low (0.07%, 22nd percentile), and it is not listed in CISA KEV.

Technical ContextAI

AOS is the firmware powering HPE Aruba wireless LAN controllers, mobility conductors/controllers, and Instant/gateway platforms that manage enterprise Wi-Fi. The flaw class is CWE-121 (stack-based buffer overflow): input passed to internal management-service components reachable via the command-line interface is copied into fixed-size stack buffers without adequate bounds checking, allowing return addresses or saved stack state to be overwritten. Because these services run with elevated privileges on the base operating system rather than inside the restricted CLI shell, a successful overflow converts admin-level CLI access into arbitrary native code execution. The single CPE covers 'hpe_aruba_networking_wireless_operating_system_(aos)' across all versions, with the EUVD enumerating specific AOS-8 (8.10-8.13) and AOS-10 (10.4-10.8) branches.

RemediationAI

Upgrade to the fixed AOS builds published in HPE advisory HPESBNW05048 (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the advisory indicates patched maintenance releases above each affected branch (for example, AOS-8 releases beyond 8.10.0.21 / 8.12.0.6 / 8.13.1.1 and AOS-10 releases beyond 10.4.1.10 / 10.7.2.2 / 10.8.0.0), but consult the advisory for the exact target version per branch rather than relying on inferred numbers. Because exploitation requires administrative CLI access, the most effective compensating controls restrict who can reach that interface: place controller/conductor management interfaces on an isolated out-of-band management VLAN and block SSH/CLI access from user and internet-facing networks (trade-off: administrators must use the management network or a jump host); enforce strong, unique per-admin credentials with MFA on the management path and eliminate shared local admin accounts; and enable command logging/AAA accounting to detect abnormal CLI activity. These controls reduce reachability but do not remove the underlying overflow, so patching remains the durable fix.