CVE-2026-44872: Aruba ArubaOS RCE Vulnerability

CVE-2026-44872 Overview

CVE-2026-44872 is a command injection vulnerability [CWE-77] in the web-based management interface of HPE Aruba Networking AOS-8 and AOS-10 Operating Systems. The flaw allows an authenticated remote attacker with high privileges to place arbitrary files on the underlying filesystem of the affected device. Successful exploitation impacts confidentiality, integrity, and availability of the device. The vulnerability also affects Aruba SD-WAN deployments running impacted AOS versions.

Critical Impact
An authenticated attacker can write arbitrary files to the device filesystem, enabling persistence, configuration tampering, or follow-on code execution on network infrastructure.

Affected Products

HPE Aruba Networking AOS-8 (ArubaOS)
HPE Aruba Networking AOS-10 (ArubaOS)
HPE Aruba Networking SD-WAN

Discovery Timeline

2026-05-12 - CVE-2026-44872 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44872

Vulnerability Analysis

The vulnerability resides in the web-based management interface of AOS-8 and AOS-10. The interface fails to properly neutralize special elements used in operating system commands, which maps to [CWE-77]. An authenticated attacker who reaches the management plane can inject command syntax that the device executes in the context of the underlying OS. Because the injection results in arbitrary file placement, attackers can stage scripts, replace configuration artifacts, or drop persistence components on the controller or gateway.

The attack vector is network-based with low complexity, but it requires high privileges on the management interface. Once a valid administrative session is obtained, no user interaction is needed to trigger the injection.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a command construction routine in the management interface. Input intended as data is concatenated into shell-interpreted strings without sufficient sanitization. This allows metacharacters to break out of the intended command context and append attacker-controlled operations.

Attack Vector

An attacker authenticates to the AOS web management interface with privileged credentials, then submits a crafted request to the vulnerable endpoint. The payload embeds shell metacharacters or chained commands that the backend executes on the underlying filesystem. The result is arbitrary file write capability on the controller, mobility gateway, or SD-WAN appliance. No verified public proof-of-concept is available, and HPE has not reported exploitation in the wild.

No verified public exploit code is available for this vulnerability. See the HPE Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-44872

Indicators of Compromise

Unexpected files appearing in writable directories on AOS controllers, gateways, or SD-WAN appliances following administrative sessions.
Web management interface requests containing shell metacharacters such as ;, |, &&, backticks, or $() in parameter values.
Administrative logins from unusual source IPs or at atypical times preceding configuration or filesystem changes.

Detection Strategies

Audit AOS web management access logs for requests with abnormal parameter content or oversized input fields on endpoints that handle command-like operations.
Correlate privileged login events with subsequent filesystem modifications or unexpected process activity reported by the device.
Enable verbose logging on the management interface and forward logs to a centralized analytics platform for anomaly review.

Monitoring Recommendations

Restrict management interface access to a dedicated administrative VLAN and monitor that segment for any unauthorized connection attempts.
Alert on changes to administrator account inventory, privilege grants, or API token issuance on AOS devices.
Track outbound connections initiated by AOS devices to identify post-exploitation callbacks or data staging.

How to Mitigate CVE-2026-44872

Immediate Actions Required

Apply the fixed AOS-8 and AOS-10 software versions identified in the HPE Aruba Networking security advisory as soon as maintenance windows permit.
Rotate administrative credentials and API tokens for AOS controllers, gateways, and SD-WAN appliances, particularly any accounts with management-plane privileges.
Restrict access to the web-based management interface to trusted management networks and remove any internet exposure.

Patch Information

HPE has released fixed firmware for affected AOS-8 and AOS-10 branches. Refer to the HPE Security Advisory for the specific patched versions corresponding to each supported release train and upgrade guidance.

Workarounds

Enable the restricted management access (CLI hardening) feature to limit the source addresses permitted to reach the web management interface.
Disable the web-based management interface where command-line or out-of-band management is sufficient, until patches are deployed.
Enforce multi-factor authentication for all administrative accounts to raise the bar for the privileged access required to exploit the flaw.

bash

# Configuration example: restrict management access to a trusted subnet
configure terminal
mgmt-user webui-cacert-userlogin
web-server
  mgmt-auth username/password
  session-timeout 300
!
ip access-list session mgmt-acl
  any host 10.10.10.0 255.255.255.0 svc-https permit
  any any any deny
!
apply mgmt-acl to interface mgmt
write memory