This vulnerability (CVE-2026-44872) affects HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It involves a command injection flaw in the web-based management interface that requires authentication. Successful exploitation allows an attacker to place arbitrary files on the device's filesystem, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Exploitation of this vulnerability could allow an authenticated remote attacker to execute arbitrary commands by injecting them through the web management interface, resulting in arbitrary file placement on the device. This can compromise the confidentiality, integrity, and availability of the affected device. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Hewlett Packard Enterprise vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. No official patches or temporary mitigations have been published as of now.