Threat Intelligence Database

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVE-2026-44864 is a high-severity SQL injection vulnerability in Hewlett Packard Enterprise's Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 through 10.8.0.0. It affects several service components accessible via the command-line interface and management protocol. An authenticated attacker with administrative privileges can inject crafted input into unsanitized parameters used in backend database queries, potentially leading to arbitrary command execution on the underlying OS. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-44857 is a high-severity stack-based buffer overflow vulnerability in Hewlett Packard Enterprise's Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 through 8.13.0.0 and 10.4.0.0 through 10.

A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2026-23809

A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+9#cve#cve-2026-23808