CVE-2026-44852: Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44852?
The severity of CVE-2026-44852 is classified as high with a score of 7.2.
What types of systems are affected by CVE-2026-44852?
CVE-2026-44852 affects Arubanetworks Arubaos and Arubanetworks SD-WAN running AOS-8 and AOS-10.
How do I fix CVE-2026-44852?
To fix CVE-2026-44852, update your systems to the latest patched versions of ArubaOS.
What exploitation risk is associated with CVE-2026-44852?
CVE-2026-44852 allows authenticated remote attackers to perform remote code execution through arbitrary file overwrite.
What is the impact of CVE-2026-44852 on confidentiality, integrity, and availability?
CVE-2026-44852 has a high impact on confidentiality, integrity, and availability due to potential arbitrary code execution.