CVE-2026-44873: Arubanetworks Arubaos Auth Bypass Flaw

CVE-2026-44873 Overview

CVE-2026-44873 is a session management vulnerability affecting Aruba Networks AOS-8 and SD-WAN products. The flaw allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions remain valid until natural expiration, even after credentials are revoked. An attacker holding compromised credentials can continue operating within the network after defenders believe access has been terminated. The issue is tracked under CWE-613: Insufficient Session Expiration.

Critical Impact

Administrative account disablement does not invalidate active sessions, allowing compromised accounts to maintain network access until session timeout.

Affected Products

• Aruba Networks ArubaOS (AOS-8)
• Aruba Networks SD-WAN
• Hewlett Packard Enterprise (HPE) Aruba networking platforms running AOS-8

Discovery Timeline

• 2026-05-12 - CVE-2026-44873 published to the National Vulnerability Database (NVD)
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-44873

Vulnerability Analysis

The vulnerability resides in the session lifecycle handling within AOS-8 and the Aruba SD-WAN component. When an administrator disables a user account, the platform revokes future authentication attempts but does not enumerate or terminate sessions already established by that identity. The session remains a valid security context until its expiration timer elapses or the user explicitly logs out.

This creates a window between credential revocation and session expiration during which a compromised account retains effective access. Incident responders who disable an account in response to suspected compromise may incorrectly assume the threat actor has been evicted. The attacker can continue to issue authenticated requests, exfiltrate data, or pivot through the network during this period.

The flaw requires the attacker to already possess valid credentials and an active session. Exploitation does not require user interaction or elevated privileges beyond those originally granted to the compromised account.

Root Cause

The root cause is the absence of a session revocation mechanism tied to account state changes. The authentication subsystem treats account disablement as a forward-looking control rather than a stateful event that propagates to existing session tokens. There is no server-side session invalidation triggered by administrative actions on the parent user record.

Attack Vector

An attacker with compromised credentials authenticates to the affected device and establishes a session. When defenders detect the compromise and disable the account, the existing session continues to authorize requests. The attacker leverages this persistence to maintain command and control, manipulate device configuration within their permission scope, or stage further activity. Verified technical details are available in the HPE Security Advisory.

Detection Methods for CVE-2026-44873

Indicators of Compromise

• Authenticated API or management interface activity from a user account that has been administratively disabled.
• Session tokens or cookies associated with disabled accounts continuing to appear in access logs.
• Configuration changes or query operations performed by accounts marked as inactive in identity management systems.

Detection Strategies

• Correlate Aruba management plane logs with identity provider events to flag authenticated activity occurring after an account-disable event.
• Enumerate active sessions on AOS-8 controllers and cross-reference against the current list of enabled accounts.
• Alert on any administrative action originating from a session whose owner is no longer in the active user store.

Monitoring Recommendations

• Forward AOS-8 authentication, authorization, and accounting (AAA) logs to a centralized SIEM for correlation with HR and IAM events.
• Establish baseline session duration metrics and flag sessions exceeding configured maximum lifetime values.
• Audit privileged session activity on a recurring schedule, focusing on accounts recently modified or disabled.

How to Mitigate CVE-2026-44873

Immediate Actions Required

• Apply the vendor-supplied patches referenced in the HPE Security Advisory to all affected AOS-8 and SD-WAN devices.
• When disabling an account in response to suspected compromise, manually terminate all active sessions for that user on every controller.
• Rotate credentials for any account suspected of compromise and force re-authentication across the management plane.

Patch Information

HPE Aruba Networking has published remediation guidance and fixed software versions in advisory hpesbnw05048en_us. Administrators should consult the advisory for the specific minimum patched versions corresponding to each AOS-8 train and the SD-WAN release in use.

Workarounds

• Reduce the configured maximum session lifetime on AOS-8 controllers to shorten the post-disable exposure window.
• Enforce short idle timeouts on management and administrative sessions to limit residual access from compromised credentials.
• Where supported, integrate AOS-8 with an external authentication source that can revoke session tickets centrally upon account changes.

# Configuration example: reduce admin session lifetime and idle timeout on AOS-8
(config) #mgmt-user session-timeout 300
(config) #web-server session-timeout 300
(config) #aaa authentication mgmt
(mgmt) #default-role read-only
(mgmt) #server-group <your-aaa-group>