What is the CVSS score of CVE-2026-44879?

CVE-2026-44879 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Which versions of HPE EdgeConnect are affected by CVE-2026-44879?

HPE Aruba/EdgeConnect SD-WAN Gateway environments are vulnerable to an authenticated command injection flaw (CVE-2026-44879, CVSS 7.2) requiring administrative-level CLI access that enables OS-level…

How to fix or mitigate CVE-2026-44879?

Within 24 hours, conduct a complete inventory of all HPE Aruba/EdgeConnect ECOS gateways in production, document their software versions, and identify all personnel with administrative CLI access. Within 7 days, implement compensating controls including: restrict administrative CLI access through role-based access control to only essential personnel; require multi-factor authentication for all elevated CLI sessions; enable comprehensive audit logging of all CLI commands and OS-level activities with real-time alerting for anomalous execution patterns; apply network segmentation to isolate ECOS gateways from sensitive network segments; and implement privileged session recording for all administrative access. Within 30 days, establish a formal security monitoring program specifically for ECOS gateway activity, complete a trust review of all administrative accounts, and monitor HPE Aruba security advisories for patch availability with a commitment to deploy patches within 48 hours of release.

HPE EdgeConnect CVE-2026-44879

EUVD-2026-46418 HIGH

Command Injection (CWE-77)

2026-07-21 hpe

GHSA-45x5-5rrf-7583

Command Injection Edgeconnect Sd Wan Gateway Ecos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

CLI reachable over the management network so AV:N/AC:L, but requires administrative CLI privileges giving PR:H; injected OS commands yield full C:H/I:H/A:H on the same appliance (S:U).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:42 vuln.today

CVE Published

Jul 21, 2026 - 20:42 cve.org

HIGH 7.2

DescriptionCVE.org

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Command injection in the command line interface of HPE Aruba/EdgeConnect SD-WAN Gateway (ECOS) allows a highly privileged, authenticated remote attacker to break out of certain CLI commands and run arbitrary commands on the underlying operating system. Because the flaw requires administrative-level CLI access (CVSS PR:H) it primarily enables an already-trusted operator to escalate from restricted CLI to full OS-level control, with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The affected component is the management CLI of HPE EdgeConnect SD-WAN Gateways running ECOS, the operating system for HPE's (formerly Silver Peak) SD-WAN edge appliances that terminate and steer WAN traffic across enterprise branch and datacenter sites. The vulnerability is a classic command injection (aligned with CWE-78, OS Command Injection, though the NVD CWE field is marked N/A): specific CLI commands pass operator-supplied arguments to the underlying shell without adequate sanitization, so shell metacharacters embedded in an argument are interpreted by the OS rather than treated as literal data. The CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):edgeconnect_sd-wan_gateway_(ecos):*:*:*:*:*:*:*:* confirms the affected product but does not pin down specific fixed versions, which must be obtained from the HPE advisory.

RemediationAI

Patch available per vendor advisory: consult HPE security bulletin hpesbnw05013en_us at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05013en_us&docLocale=en_US and upgrade ECOS to the fixed release listed there - no exact fix version was included in the provided data, so do not act on an assumed version number. Because exploitation requires high-privileged CLI access, the most effective compensating controls are to tightly restrict and audit administrative accounts: enforce least privilege and remove unnecessary admin/CLI accounts, mandate strong unique credentials plus MFA on the management plane, and restrict the appliance management CLI (SSH/console) to a dedicated out-of-band or jump-host management network via ACLs so it is not reachable from general or WAN-facing segments - the trade-off is added operational friction for legitimate administrators. Additionally enable command and session logging to detect anomalous CLI usage; note this is detective, not preventive.