What is the CVSS score of CVE-2026-44860?

CVE-2026-44860 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44860?

HPE Aruba Wireless Operating System (AOS-8/AOS-10) contains a SQL injection vulnerability allowing authenticated administrators to escalate privileges and execute arbitrary OS commands on network…

How to fix or mitigate CVE-2026-44860?

Within 24 hours: Inventory all HPE Aruba AOS-8 and AOS-10 deployments, document running versions, and review administrative access logs for suspicious CLI or management protocol activity. Within 7 days: Deploy multi-factor authentication (MFA) for all administrative access to controllers, restrict CLI and management protocol access to explicitly authorized personnel, and isolate controller management interfaces from untrusted networks. Within 30 days: Implement continuous audit logging of all administrative CLI commands and management protocol interactions, deploy network-based intrusion detection/prevention (IDS/IPS) signatures to detect SQL injection patterns in controller traffic, establish RBAC to enforce principle of least privilege for admin roles, and request a patch timeline from HPE while planning staged testing of updates in non-production environments.

HPE Aruba AOS CVE-2026-44860

EUVD-2026-29810 HIGH

SQL Injection (CWE-89)

2026-05-12 hpe

GHSA-9r55-7fpw-rrpv

SQLi Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management plane (AV:N) and low complexity (AC:L), but administrative authentication is mandatory (PR:H); OS command execution yields full C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:53 vuln.today

CVE Published

May 12, 2026 - 19:05 nvd

HIGH 7.2

DescriptionCVE.org

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator escalate to arbitrary OS command execution on the underlying controller/gateway by injecting crafted input through the CLI and management protocol into unsanitized backend database queries. Because exploitation demands existing administrative access (PR:H), it functions primarily as a privilege-boundary and integrity-escape issue rather than an initial-access vector, but the CVSS:3.1 base of 7.2 reflects total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 8th percentile), and CISA SSVC records exploitation as none.

Technical ContextAI

The affected component is HPE Aruba Networking's AOS, the operating system running on Aruba wireless LAN controllers, mobility gateways, and Instant/Mobility Conductor deployments (both the AOS-8 and cloud-native AOS-10 architectures). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): several underlying service components reachable through the administrative CLI and management protocol pass operator-supplied parameters directly into backend SQL queries without sanitization. Because these backend services execute in a privileged context on the embedded OS, injection is not limited to database data manipulation - crafted input can pivot into arbitrary OS command execution, indicating the SQL layer interfaces with or shells out to system-level operations. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos) confirms the single affected product family across multiple maintenance trains.

RemediationAI

Apply the fixed AOS maintenance releases published in HPE Security Bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); upgrade each affected branch to the first release above the listed vulnerable ceilings (i.e., beyond 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and off 10.8.0.0) - consult the bulletin for the exact patched build numbers, which should be taken from HPE rather than assumed, as this analysis does not independently confirm specific fixed version strings. Because exploitation requires administrative access over the management plane, the most effective compensating controls until patching are to restrict and isolate management access: place the CLI/management interfaces on a dedicated out-of-band management VLAN reachable only from a hardened jump host, enforce strict ACLs so only known administrator source addresses can reach the controller/gateway management protocol, and enforce strong, unique, MFA-backed admin credentials with least-privilege role separation to shrink the pool of accounts that could abuse the flaw. Enable and monitor administrative CLI and configuration audit logging to detect anomalous parameter input from admin sessions. The trade-off of tightening management-plane access is potential disruption to legitimate remote administration and monitoring tooling, so validate management reachability for NOC/automation systems before locking down ACLs.