What is the CVSS score of CVE-2026-44866?

CVE-2026-44866 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44866?

HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) contains an authenticated command injection flaw (CVE-2026-44866, CVSS 7.2) permitting high-privilege administrators to bypass safety…

How to fix or mitigate CVE-2026-44866?

Within 24 hours, identify all AOS-8 and AOS-10 deployments across your infrastructure and review administrative access logs for the past 90 days to surface any anomalous command patterns. Within 7 days, implement compensating controls: restrict the management interface to a hardened administrative network segment, enforce multi-factor authentication for all administrative accounts, consider disabling web-based management in favor of SSH-only CLI access, and rotate all administrator credentials. Within 30 days, monitor HPE security advisories for patch availability (subscribe to HPE security updates), prepare and test a firmware upgrade plan for affected controllers, and conduct a formal access review of all administrator roles to minimize the blast radius of any single compromised account.

HPE Aruba AOS CVE-2026-44866

EUVD-2026-29816 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-x49r-fpf3-6x75

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management interface (AV:N/AC:L) but requires an authenticated high-privilege admin (PR:H); command injection yields full OS control on the same device, so C:H/I:H/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:49 vuln.today

CVE Published

May 12, 2026 - 19:12 nvd

HIGH 7.2

DescriptionCVE.org

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Authenticated command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privilege remote administrator break out of the intended CLI/GUI context and run arbitrary OS commands on the underlying controller/gateway. Multiple 8.x and 10.x branches are affected, giving full confidentiality, integrity, and availability impact (total technical impact per SSVC). There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the flaw is not listed in CISA KEV, so it currently represents a patch-on-schedule rather than emergency issue.

Technical ContextAI

AOS is HPE Aruba's operating system for wireless LAN controllers, mobility gateways, and conductor/managed-node deployments; the exposed surface here is the HTTPS-based management interface used by network operators. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning operator-supplied input in one or more management endpoints is passed into an OS shell context without adequate sanitization, allowing shell metacharacters to inject additional commands. Because the interface runs with elevated system privileges, injected commands execute directly on the base operating system rather than being confined to the vendor's restricted management shell. The affected component is identified by CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos):*, covering both the AOS-8 and AOS-10 architectures.

RemediationAI

Patch available per vendor advisory - apply the fixed AOS builds published in HPE security bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the input data does not specify exact fixed version numbers, so obtain the target release for your branch directly from that bulletin (the listed vulnerable ranges such as 8.10.0.0-8.10.0.21, 8.12.0.0-8.12.0.6, 8.13.0.0-8.13.1.1, 10.4.0.0-10.4.1.10, 10.7.0.0-10.7.2.2, and 10.8.0.0 indicate the branches needing an upgrade). Because exploitation requires an authenticated high-privilege session, the highest-value compensating controls are to restrict reachability of the management interface: place the AOS web management interface on a dedicated out-of-band management VLAN and block HTTPS management access from user/data networks and the internet (trade-off: administrators must connect via the management network or VPN). Additionally, tighten administrator account hygiene - enforce unique strong credentials, enable multi-factor authentication for management logins, rotate any shared admin passwords, and audit management-interface access logs for anomalous command activity (trade-off: minimal operational friction, high detective value). These controls reduce the pool of actors who can reach PR:H but are not a substitute for the vendor patch.