What is the CVSS score of CVE-2026-44870?

CVE-2026-44870 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44870?

HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) contains a high-severity authenticated command injection vulnerability (CVSS 7.2) that allows high-privilege administrators to…

How to fix or mitigate CVE-2026-44870?

Within 24 hours, enumerate all HPE Aruba AOS-8 and AOS-10 controllers and gateways in your environment and audit high-privilege account assignments, with focus on accounts with PAPI protocol access. Within 7 days, implement network segmentation and firewall rules restricting PAPI protocol traffic to only trusted administrative networks, enforce mandatory MFA on all high-privilege administrative accounts, and disable PAPI protocol service on any controllers where it is not operationally required. Within 30 days, establish recurring access reviews for high-privilege accounts (minimum 30-day intervals), enable comprehensive logging and alerting on PAPI protocol and CLI command activity, and subscribe to HPE Aruba security advisories to deploy patches immediately upon release.

HPE Aruba AOS CVE-2026-44870

EUVD-2026-29820 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-49xw-4vmp-5jg9

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable CLI over PAPI (AV:N, AC:L, UI:N) but requires administrative CLI access (PR:H); command injection yields full OS control, so C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:44 vuln.today

CVE Published

May 12, 2026 - 19:16 nvd

HIGH 7.2

DescriptionCVE.org

Command injection vulnerabilities exist in the command line interface (CLI) service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Authenticated command injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets a high-privileged remote attacker break out of the CLI service reached over the PAPI protocol and run arbitrary OS commands on the underlying controller or gateway. The flaw carries CVSS 7.2 (high) with total technical impact, but there is no public exploit identified at time of analysis and CISA's SSVC rates exploitation as none and non-automatable. EPSS is low at 0.19% (41st percentile), consistent with the high-privilege prerequisite limiting opportunistic mass exploitation.

Technical ContextAI

The affected component is the CLI service on Aruba Mobility Controllers, Mobility Conductors, and gateways running AOS-8 and AOS-10, which is administered via PAPI - Aruba's proprietary UDP-based process/inter-controller management protocol used for control-plane communication among Aruba WLAN devices. The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning user-supplied input passed to CLI handlers is not sanitized before being incorporated into a shell/OS command, allowing operators to escape the constrained CLI into the underlying operating system. The single CPE provided (cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos)) identifies the AOS network operating system itself as the vulnerable software rather than a specific hardware model.

RemediationAI

Upgrade AOS to the fixed maintenance release for your branch as directed by HPE advisory hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the input lists the last-vulnerable versions per branch (e.g., 8.10.0.21, 8.12.0.6, 8.13.1.1, 10.4.1.10, 10.7.2.2, and 10.8.0.0), so apply the next HPE-published patched build above these - a specific patched version is not independently confirmed here and should be taken from the advisory. Because exploitation requires high-privilege CLI access, the strongest compensating controls target that access: restrict management-plane and PAPI reachability to a dedicated, firewalled administration VLAN or out-of-band network so only trusted hosts can reach the CLI service (trade-off: administrators must operate from jump hosts); enforce role-based CLI accounts with least privilege and remove shared admin credentials so fewer principals can reach the vulnerable handlers; and enable strong authentication (TACACS+/RADIUS with MFA) plus command auditing on controllers/conductors to detect misuse (trade-off: added AAA infrastructure dependency). Blocking or ACL-restricting PAPI (UDP) between untrusted segments and controllers reduces the remote-reach surface but can disrupt legitimate inter-controller/AP communication, so scope it carefully.