CVE-2026-44861: Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44861?
CVE-2026-44861 is classified as a critical vulnerability due to its potential for authenticated remote code execution.
How do I fix CVE-2026-44861?
To remediate CVE-2026-44861, upgrade your ArubaOS to the latest version that addresses this SQL injection vulnerability.
Who is affected by CVE-2026-44861?
CVE-2026-44861 affects users of ArubaOS versions 8 and 10, specifically those utilizing certain command-line interfaces and management protocols.
What type of attack does CVE-2026-44861 enable?
CVE-2026-44861 enables authenticated attackers to execute arbitrary code on affected systems through SQL injection.
When was CVE-2026-44861 disclosed?
CVE-2026-44861 was disclosed recently, reflecting ongoing vulnerabilities in the AOS-8 and AOS-10 operating systems.