CVE-2026-44863: Arubanetworks ArubaOS SQLi Vulnerability

CVE-2026-44863 Overview

CVE-2026-44863 affects Aruba Networks ArubaOS, specifically the AOS-8 and AOS-10 platforms. The flaw resides in several underlying service components reachable through the command-line interface (CLI) and management protocol. An authenticated attacker with administrative privileges can inject crafted input into parameters passed unsanitized to backend database queries. Successful exploitation allows arbitrary command execution on the underlying operating system, breaking the boundary between the management plane and the host OS. The vulnerability is classified under [CWE-89] (SQL Injection) and impacts ArubaOS and the Aruba SD-WAN product line.

Critical Impact

An authenticated administrator can pivot from SQL injection in management components to arbitrary command execution on the underlying operating system of ArubaOS controllers and SD-WAN gateways.

Affected Products

• Aruba Networks ArubaOS (AOS-8 and AOS-10 branches)
• Aruba Networks SD-WAN
• ArubaOS management plane components exposed via CLI and management protocol

Discovery Timeline

• 2026-05-12 - CVE-2026-44863 published to the National Vulnerability Database
• 2026-05-14 - Last updated in NVD
• 2026-05-17 - EPSS scoring data published

Technical Details for CVE-2026-44863

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] within multiple service components of ArubaOS AOS-8 and AOS-10. These components accept input through the CLI and the management protocol used by administrators to configure controllers and gateways. User-supplied parameters flow into backend database queries without proper sanitization or parameterization.

Because the affected services interact with the underlying operating system, injected SQL payloads do not stop at data tampering. The advisory states that successful exploitation can result in arbitrary command execution on the host OS. This effectively elevates a SQL injection primitive into full OS-level compromise of the network device.

Exploitation requires high privileges, since the attacker must already be authenticated as an administrator. Network reachability to the management interface is required, and no user interaction is needed.

Root Cause

The root cause is missing input validation and a lack of parameterized queries in service components processing CLI and management protocol parameters. Operator-supplied fields are concatenated into SQL statements that are then executed against backend databases tied to system-level functionality.

Attack Vector

An attacker with valid administrator credentials connects to the ArubaOS management protocol or CLI over the network. The attacker submits crafted input in a parameter consumed by a vulnerable service component. The injected SQL is executed against the backend database and ultimately triggers OS command execution on the controller or SD-WAN gateway.

For exploitation details, see the HPE Security Advisory.

Detection Methods for CVE-2026-44863

Indicators of Compromise

• Unexpected administrator CLI sessions originating from unusual source IPs or outside normal change windows.
• CLI or management protocol commands containing SQL metacharacters such as single quotes, semicolons, UNION, or comment sequences (--, /*).
• New or unexpected processes spawned by ArubaOS service components following administrative activity.
• Outbound connections from controllers or SD-WAN gateways to unknown infrastructure shortly after admin logins.

Detection Strategies

• Enable and centralize ArubaOS audit logging for CLI and management protocol activity, including full command strings.
• Alert on administrator commands that include SQL syntax patterns or shell metacharacters in parameter values.
• Baseline normal admin behavior and flag deviations such as off-hours access, new admin accounts, or rapid configuration changes.

Monitoring Recommendations

• Forward ArubaOS syslog and management plane telemetry to a SIEM for correlation with identity and network events.
• Monitor for changes to local accounts, role assignments, and configuration files on controllers and gateways.
• Track egress traffic from management interfaces to detect post-exploitation command-and-control behavior.

How to Mitigate CVE-2026-44863

Immediate Actions Required

• Apply the fixed ArubaOS versions referenced in the HPE Security Advisory for AOS-8, AOS-10, and SD-WAN deployments.
• Restrict management plane access to a dedicated, isolated management network and trusted jump hosts.
• Rotate administrative credentials and enforce multi-factor authentication for all ArubaOS administrators.
• Audit existing administrator accounts and remove unused or shared accounts.

Patch Information

Hewlett Packard Enterprise has published fixed software builds for affected AOS-8, AOS-10, and SD-WAN releases. Refer to the HPE Security Advisory for the specific patched versions corresponding to each supported branch and apply them according to vendor guidance.

Workarounds

• Disable or block external access to the ArubaOS CLI and management protocol on untrusted interfaces.
• Apply access control lists that limit management protocol connections to specific administrator source addresses.
• Reduce the number of accounts holding administrative privileges to limit the population of users capable of exploiting the flaw.

# Example: restrict ArubaOS management access to a trusted subnet
ip access-list session mgmt-restrict
  user host 10.10.0.0 255.255.255.0 svc-https permit
  user any svc-https deny
  user any svc-ssh deny
!
interface vlan 1
  ip access-group mgmt-restrict session