CVE-2026-44873 Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating System
Attackers with compromised credentials retain network access after account deactivation due to insufficient session invalidation in HPE Aruba AOS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44873?
CVE-2026-44873 is a medium-severity authentication bypass vulnerability in Arubanetworks Arubaos, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.
Weakness: CWE-613
Which versions are affected by CVE-2026-44873?
It affects 2 products.
Products include Arubanetworks Arubaos, Arubanetworks Sd-Wan.
How do I fix CVE-2026-44873?
No fix has been published for CVE-2026-44873 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-44873 being exploited?
There is no known exploitation of CVE-2026-44873 in the wild and no public exploit code.
Other vulnerabilities in Arubanetworks Arubaos
- CVE-2024-42393 Memory corruption in Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42394 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42395 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
- CVE-2024-31467 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
Sources
Also known as GHSA-h57h-82mj-62h6.