This vulnerability (CVE-2026-44867) affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It is a command injection issue (CWE-77) that allows an authenticated remote attacker to execute arbitrary commands on the underlying OS. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation details, and no exploits are currently known in the wild.

Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system, potentially leading to full compromise of the affected device. This impacts confidentiality, integrity, and availability of the system. However, exploitation requires authentication, which limits the attack surface to users with valid credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.