What is the CVSS score of CVE-2026-44865?

CVE-2026-44865 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Aruba AOS are affected by CVE-2026-44865?

HPE Aruba Networking wireless controllers running AOS-8 (versions 8.10.x-8.13.x) and AOS-10 (versions 10.4.x-10.8.x) contain an authenticated command injection vulnerability that could allow a…

How to fix or mitigate CVE-2026-44865?

Within 24 hours, identify all deployed AOS-8 and AOS-10 systems and audit privileged web management interface credentials to establish baseline risk exposure. Within 7 days, implement network-based access controls restricting the management interface to dedicated admin workstations or jump hosts, enable comprehensive logging for all management interface sessions, and enforce multi-factor authentication for all privileged accounts if not already deployed. Within 30 days, review HPE advisory hpesbnw05048en_us for guidance on affected branches, develop a version-upgrade timeline for migration to unaffected AOS releases, and establish a monitoring cadence for HPE security bulletins.

Aruba AOS CVE-2026-44865

EUVD-2026-29815 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-xmjv-8g3f-2ppc

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management interface (AV:N/AC:L) but requires an authenticated high-privilege admin (PR:H); command injection yields full OS control (C:H/I:H/A:H) on the same appliance (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:50 vuln.today

CVE Published

May 12, 2026 - 19:12 nvd

HIGH 7.2

DescriptionCVE.org

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote attacker who already holds high-privilege access to the web-based management interface to execute arbitrary operating-system commands on the controller/gateway. The flaw affects multiple AOS-8 (8.10.x-8.13.x) and AOS-10 (10.4.x-10.8.x) branches per HPE advisory hpesbnw05048en_us and carries CVSS 7.2 (High). There is no public exploit identified at time of analysis, EPSS is low (0.18%, 39th percentile), and CISA SSVC records exploitation status as none.

Technical ContextAI

AOS is the operating system running on HPE Aruba Networking wireless infrastructure - mobility controllers, gateways, and Mobility Conductor (formerly Mobility Master) - that manage enterprise Wi-Fi deployments. The vulnerability class is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the web management interface passes attacker-influenced input into an underlying OS shell/command execution path without adequate sanitization. Because AOS is an appliance OS, successful command injection breaks out of the constrained management application into the underlying Linux-based host context. The single affected-product CPE is cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), and HPE (the CNA) reports the issue across both the AOS-8 and next-generation AOS-10 code lines.

RemediationAI

Apply the fixed AOS releases published in HPE Security Bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US) - upgrade each affected branch to the version above its listed vulnerable ceiling (i.e., beyond 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and off the affected 10.8.0.0); consult the bulletin for the exact patched build numbers, which should be taken from the advisory rather than assumed. Patch available per vendor advisory; exact fixed version numbers are not restated in the provided data and should be confirmed from the HPE bulletin. Because exploitation requires authenticated high-privilege access to the web management interface, the strongest compensating control until patching is to restrict reachability of that interface: place controller/gateway/Mobility Conductor management on a dedicated out-of-band management VLAN, block the management HTTPS interface from user and internet-facing networks via ACLs/firewall, and require VPN or jump-host access to reach it (trade-off: adds operational friction for remote administrators). Additionally, enforce strong, unique admin credentials with MFA, minimize the number of privileged management accounts, and audit management-interface logins for anomalous activity, since a valid privileged session is the precondition for exploitation.