What is the CVSS score of CVE-2026-44872?

CVE-2026-44872 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of HPE Aruba AOS are affected by CVE-2026-44872?

HPE Aruba AOS-8 and AOS-10 wireless controllers and access points contain a command injection vulnerability enabling authenticated administrators to write arbitrary files to affected systems,…

How to fix or mitigate CVE-2026-44872?

Within 24 hours: identify and inventory all HPE Aruba AOS-8 and AOS-10 wireless controllers and access points in your environment; audit current administrative account holders and their access logs. Within 7 days: restrict network access to the web-based management interface to approved administrative networks only using firewall rules or VPN requirements; enforce multi-factor authentication on all administrative accounts if not already deployed; enable comprehensive logging of management interface activities. Within 30 days: monitor HPE security advisories for patch availability; conduct a credential audit to identify and remediate inactive or shared administrative accounts; consider implementing just-in-time administrative access controls.

HPE Aruba AOS CVE-2026-44872

EUVD-2026-29821 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-p4r4-r264-p9hw

Command Injection Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management UI (AV:N/AC:L) but requires admin privileges (PR:H); arbitrary file write via command injection plausibly yields full device compromise, so C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:44 vuln.today

CVE Published

May 12, 2026 - 19:18 nvd

HIGH 7.2

DescriptionCVE.org

A command injection vulnerability exists in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated remote attacker to place arbitrary files on the underlying filesystem of the affected device.

AnalysisAI

Command injection in the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated, high-privileged remote attacker to write arbitrary files onto the underlying device filesystem, enabling potential full compromise of affected wireless controllers and access points. The flaw (CWE-77) carries a CVSS 7.2 rating with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS probability is low at 0.25%. Exploitation currently requires administrative-level credentials, which meaningfully constrains real-world risk despite the network attack vector.

Technical ContextAI

AOS is the embedded operating system running on HPE Aruba wireless LAN controllers (Mobility Controllers/Gateways) and campus access points, exposing an HTTP(S)-based management interface for device administration. The vulnerability is a CWE-77 command injection: user-supplied input reaching the management interface is passed to an underlying OS-level command or file-handling routine without sufficient sanitization, allowing an attacker to break out of the intended command context and place arbitrary files on the device filesystem. The single affected CPE, cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), confirms the scope is limited to the Aruba wireless OS rather than Aruba's switching (AOS-CX) or other product lines. Arbitrary file write on a network appliance is frequently a stepping stone to arbitrary code execution or persistence, which aligns with the SSVC 'total' technical-impact rating.

RemediationAI

Upgrade to the fixed AOS release for your branch as published in HPE bulletin hpesbnw05048en (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the affected-version ranges indicate fixes land in releases above 10.7.2.2, 10.4.1.10, 8.13.1.1, 8.12.0.6, and 8.10.0.21, but confirm the exact patched build numbers directly from the advisory rather than assuming, and note that 10.8.0.0 is listed as affected so verify HPE's specified fixed 10.8.x build. Because exploitation requires an authenticated high-privilege session, the most effective compensating control until patching is to restrict reachability of the web management interface: place management on a dedicated out-of-band management VLAN and block HTTP/HTTPS management access from user and internet-facing segments via ACLs, accepting the trade-off that legitimate remote administration must then traverse a bastion or VPN. Additionally enforce strong, unique administrator credentials with MFA where supported and rotate any shared admin accounts, and monitor management-interface logins and configuration/file changes for anomalies, since these controls reduce the chance an attacker obtains the PR:H access the exploit depends on.