An authenticated remote code execution vulnerability exists in HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. The flaw resides in the certificate download feature of the web-based management interface, where improper input validation of the file path parameter allows an attacker to overwrite arbitrary files on the underlying OS. Successful exploitation grants execution of arbitrary commands with privileged user permissions. The vulnerability is tracked as CVE-2026-44852 with a CVSS 3.1 base score of 7.2 (high severity). No vendor advisory or patch links are currently provided, and no known exploits have been reported.

Exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary commands on the underlying operating system with privileged user rights by overwriting arbitrary files. This could lead to full system compromise, affecting confidentiality, integrity, and availability of the affected device. The CVSS score of 7.2 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity related to certificate management functions. Avoid exposing the management interface to untrusted networks.