CVE-2026-44864 Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
An authenticated administrator can execute arbitrary OS commands via SQL injection in Aruba AOS management interfaces.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44864?
CVE-2026-44864 is a high-severity SQL injection vulnerability in Arubanetworks Arubaos, published on 12 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Weakness: CWE-89
Which versions are affected by CVE-2026-44864?
It affects 2 products.
Products include Arubanetworks Arubaos, Arubanetworks Sd-Wan.
How do I fix CVE-2026-44864?
No fix has been published for CVE-2026-44864 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-44864 being exploited?
There is no known exploitation of CVE-2026-44864 in the wild and no public exploit code.
Other vulnerabilities in Arubanetworks Arubaos
- CVE-2024-42393 Memory corruption in Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42394 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42395 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
- CVE-2024-31467 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
Sources
Also known as GHSA-9xv7-mm2m-gv6c.