What is the CVSS score of CVE-2026-44863?

CVE-2026-44863 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Aruba AOS are affected by CVE-2026-44863?

HPE Aruba Wireless Operating System controllers (AOS-8, AOS-10) allow administrative users to execute arbitrary operating system commands via unsanitized input to CLI and management protocols.

How to fix or mitigate CVE-2026-44863?

Within 24 hours: audit all HPE Aruba AOS-8 and AOS-10 controllers in your environment and review current administrative account access and usage patterns. Within 7 days: implement network segmentation to restrict CLI and management-protocol access to dedicated administrative networks, enforce multi-factor authentication for all administrative accounts, and disable unused management protocols. Within 30 days: establish command and query logging and alerting on affected controllers, confirm patch availability status with HPE Aruba, and plan the upgrade timeline to patched versions when released.

Aruba AOS CVE-2026-44863

EUVD-2026-29813 HIGH

SQL Injection (CWE-89)

2026-05-12 hpe

GHSA-3q8r-gjx2-h6v2

SQLi Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management interface (AV:N) but requires administrative privileges (PR:H); low complexity (AC:L) and OS command execution yields total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:52 vuln.today

CVE Published

May 12, 2026 - 19:09 nvd

HIGH 7.2

DescriptionCVE.org

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Arbitrary OS command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) is achievable when an administratively-privileged operator injects crafted input into CLI and management-protocol parameters that reach backend database queries unsanitized. Multiple underlying service components are affected across the WLAN controller/gateway software family, and successful exploitation escalates from SQL injection to full command execution on the host OS. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 8th percentile), and CISA SSVC rates exploitation as none but technical impact as total.

Technical ContextAI

The affected technology is HPE Aruba's wireless controller/gateway operating system (AOS), which runs the management plane for Aruba WLAN infrastructure and exposes configuration through a CLI and a management protocol. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): operator-supplied parameters are concatenated into backend database queries without sanitization across several internal service components. Because those backend services run with high privilege on the underlying OS, the injection does not merely tamper with data but is escalated by the vendor's own description to arbitrary command execution on the host operating system. The single CPE provided - cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos):*:*:*:* - scopes this to the AOS software product rather than a specific hardware controller model.

RemediationAI

Patch available per vendor advisory: upgrade AOS to the fixed release for your branch as published in HPE advisory hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the input provides affected ceilings (for example 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2) but the exact patched build numbers must be taken from that advisory rather than assumed. Because exploitation requires administrative privileges, the most effective compensating controls until patching are to restrict and harden management-plane access: limit the CLI and management protocol to a dedicated out-of-band management VLAN or ACL-protected subnet so the interface is not broadly network-reachable (trade-off: legitimate remote admins must connect via that path or a jump host), enforce strong per-admin authentication with unique accounts and audit logging to reduce credential-sharing and detect misuse, and apply least-privilege role separation so fewer operators hold the full administrative role that this flaw requires (trade-off: added operational overhead). These controls reduce exposure but do not eliminate the vulnerability, since a legitimate admin can still trigger it.