What is the CVSS score of CVE-2026-44862?

CVE-2026-44862 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44862?

HPE Aruba Networking Wireless Operating System (AOS versions 8.10-8.13 and 10.4-10.8) contains a SQL injection vulnerability in administrative backend services that permits authenticated…

How to fix or mitigate CVE-2026-44862?

Within 24 hours, identify all HPE Aruba devices running AOS 8.10-8.13 or 10.4-10.8 in your environment and immediately restrict administrative CLI and management protocol access to a minimal set of trusted personnel; enable detailed audit logging on all administrative interfaces. Within 7 days, review and downscope administrator account privileges to least-privilege principles, implement network-layer access controls limiting administrative endpoints to authorized workstations only, and configure alerting for suspicious command execution patterns in administrative activity logs. Within 30 days, establish a tracking process for HPE Aruba security advisories to identify patch availability for these specific versions, develop an upgrade timeline if patches are released, and evaluate intrusion detection rules to detect SQL injection signatures in management traffic as interim defense.

HPE Aruba AOS CVE-2026-44862

EUVD-2026-29812 HIGH

SQL Injection (CWE-89)

2026-05-12 hpe

GHSA-gjx8-9fq3-fvgf

SQLi Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management plane (AV:N) with low complexity, but requires existing administrative authentication (PR:H); SQLi-to-OS-command execution yields total confidentiality, integrity, and availability impact on the device.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:52 vuln.today

CVE Published

May 12, 2026 - 19:08 nvd

HIGH 7.2

DescriptionCVE.org

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into unsanitized parameters within several backend service components reached via the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS. It affects a broad range of AOS 8.10 through 8.13 and 10.4 through 10.8 releases and carries a CVSS 7.2 (High) rating. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03%.

Technical ContextAI

The affected platform is HPE Aruba Networking's AOS, the operating system that powers Aruba wireless mobility controllers/conductors and gateways (CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos)). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied values entering through the command-line interface and the management protocol are concatenated into backend database queries without sanitization. Because these backend service components run with high OS privilege and the database layer can be leveraged to invoke OS-level operations, the SQLi escalates from data-layer manipulation to arbitrary command execution on the host operating system, blurring the line between an injection flaw and full device compromise.

RemediationAI

Apply the fixed AOS releases published in HPE Security Bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); patch status here is 'Patch available per vendor advisory' - consult the bulletin for the exact fixed build for your branch (8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x, and 10.8.0.0), as specific patched version numbers are not independently confirmed in the input data. Because exploitation requires administrative authentication, the strongest compensating controls harden the management plane: restrict CLI and management-protocol access to a dedicated out-of-band management VLAN or ACL so only trusted operator hosts can reach the controller (trade-off: legitimate remote admins must use the bastion path), enforce strong unique admin credentials with role-based access control and MFA to shrink the pool of accounts that could abuse the flaw, and enable command/audit logging plus alerting on anomalous CLI/config activity to detect misuse. These controls reduce exposure but do not remove the vulnerability - upgrading is the only complete fix.