This vulnerability (CVE-2026-44868) affects HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It involves command injection in the web-based management interface, allowing an authenticated remote attacker to execute arbitrary OS commands. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command). No patch or official remediation level has been published by HPE as of now.

Successful exploitation could lead to full compromise of the affected device by allowing execution of arbitrary commands with high privileges. This impacts confidentiality, integrity, and availability of the device and potentially the network it manages. However, exploitation requires authenticated access, limiting exposure to attackers who can authenticate to the management interface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the management interface to trusted administrators only and monitor for suspicious activity. Do not expose the management interface to untrusted networks.