What is the CVSS score of CVE-2026-44868?

CVE-2026-44868 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44868?

HPE Aruba Networking AOS-8 and AOS-10 wireless controllers contain an authenticated command injection vulnerability (CVE-2026-44868, CVSS 7.2) enabling high-privilege network administrators to escape…

How to fix or mitigate CVE-2026-44868?

Within 24 hours: Identify and inventory all HPE Aruba AOS-8 and AOS-10 wireless controllers; restrict administrative console access to trusted networks and enable multi-factor authentication for all administrative accounts if available in your AOS version. Within 7 days: Conduct a thorough audit of administrative access (past 90 days) and access logs for suspicious activity; revoke or reset credentials for any shared or inactive administrative accounts. Within 30 days: Subscribe to HPE security advisories and contact HPE support for CVE-2026-44868 patch release timeline; apply vendor patch immediately upon release. Maintain the compensating controls detailed below until patching is complete, and conduct quarterly reviews of administrative access privileges.

HPE Aruba AOS CVE-2026-44868

EUVD-2026-29818 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-6999-crm6-63wv

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Management interface is network-reachable (AV:N/AC:L) but requires admin privileges (PR:H); OS command execution yields total confidentiality, integrity, and availability impact on the unchanged scope device.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:49 vuln.today

CVE Published

May 12, 2026 - 19:15 nvd

HIGH 7.2

DescriptionCVE.org

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Authenticated command injection in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 wireless operating systems (CVE-2026-44868, CWE-77) lets a high-privileged remote attacker execute arbitrary OS commands on the underlying controller/gateway. HPE self-reported the flaw; there is no public exploit identified at time of analysis and it is not in CISA KEV, and the low EPSS (0.18%, 39th percentile) reflects no observed exploitation. The primary risk is a privileged operator or a hijacked admin session escaping the constrained management CLI/UI to full root-level control of the network infrastructure device.

Technical ContextAI

AOS (ArubaOS) is the network operating system running on HPE Aruba wireless LAN controllers and mobility gateways/conductors; AOS-8 is the legacy Mobility Controller line and AOS-10 is the cloud-native gateway architecture. The affected component is the HTTPS web management interface, which passes user-supplied input into underlying operating-system shell context without sufficient neutralization - the classic CWE-77 (Command Injection) root cause where administrative parameters are concatenated into a system command. Successful injection breaks out of the intended management abstraction and runs commands directly on the embedded Linux/OS layer. The single CPE provided (cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos)) confirms the affected product is the AOS software itself rather than a specific hardware model.

RemediationAI

Patch available per vendor advisory (HPE hpesbnw05048en_us) - upgrade each affected branch to a build above the listed vulnerable ceiling (i.e., beyond 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and off the 10.8.0.0 baseline); consult the HPE bulletin at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US for the exact fixed version numbers, which are not independently reproduced here to avoid inventing versions. As the primary compensating control while patching, restrict access to the web management interface to a dedicated management VLAN or trusted admin subnet and never expose it to the internet - the trade-off is legitimate remote administration must route through VPN/jump host. Additionally enforce strong, unique admin credentials with MFA and role separation to limit who holds the PR:H access this exploit requires, and monitor management-plane logs for anomalous CLI/command activity; these reduce the credential-theft attack surface but do not remove the underlying injection, so patching remains mandatory.