What is the CVSS score of CVE-2026-44869?

CVE-2026-44869 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44869?

HPE Aruba Wireless Operating System (AOS 8 and 10) is vulnerable to command injection through the management interface, enabling high-privilege authenticated users to fully compromise wireless…

How to fix or mitigate CVE-2026-44869?

Within 24 hours, inventory all HPE Aruba AOS deployments and identify systems running affected versions (8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x, 10.8.0). Within 7 days, implement network segmentation to restrict management interface access to a dedicated jump host or management network, audit and document all high-privilege account holders on these devices, and enable detailed logging of management interface commands. Within 30 days, establish contact with HPE support regarding patch timelines and evaluate alternative AOS versions outside the affected trains, developing a vendor upgrade roadmap.

HPE Aruba AOS CVE-2026-44869

EUVD-2026-29819 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-cmjj-6mrh-4xj8

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management interface (AV:N/AC:L) but requires an authenticated high-privilege admin (PR:H), no user interaction, and command injection yields total OS compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:45 vuln.today

CVE Published

May 12, 2026 - 19:15 nvd

HIGH 7.2

DescriptionCVE.org

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated remote attacker with high privileges (PR:H) execute arbitrary OS commands on the underlying controller/gateway, yielding full compromise of the wireless infrastructure device. Affected trains include AOS 8.10.x/8.12.x/8.13.x and 10.4.x/10.7.x/10.8.0. There is no public exploit identified at time of analysis, and SSVC lists exploitation as none; EPSS is low at 0.18% (39th percentile).

Technical ContextAI

AOS is HPE Aruba's operating system running on mobility controllers, gateways, and managed WLAN infrastructure that centrally administers enterprise wireless networks. The flaw is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the web management interface passes user-supplied input into an OS-level command or shell invocation without adequate sanitization, allowing injected metacharacters to break out and run attacker-chosen commands. The single CPE covers cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), spanning both the AOS-8 (controller-based) and AOS-10 (cloud-native/microservices) generations, indicating the vulnerable code path exists across both architecture families' management planes.

RemediationAI

Apply the fixed AOS builds referenced in HPE Security Bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the input lists affected version ceilings but the exact patched release numbers should be taken directly from that advisory rather than inferred, so upgrade past the affected ranges (beyond 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and off 10.8.0.0) to the vendor-designated fixed versions. Because exploitation requires an authenticated high-privilege session, the most effective compensating control is to restrict who can reach the web management interface: place management on a dedicated out-of-band VLAN and block the HTTPS management port from user/data VLANs and the internet (trade-off: administrators must connect via the management network or VPN), enforce strong unique admin credentials with MFA where supported, and tightly limit and monitor administrative accounts (trade-off: operational overhead). Enable logging/auditing of management-interface command activity to detect abuse until patching completes.