CVE-2026-44864: Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44864?
CVE-2026-44864 is classified as a critical vulnerability due to its potential for unauthenticated remote code execution via SQL injection.
How do I fix CVE-2026-44864?
To fix CVE-2026-44864, upgrade AOS-8 and AOS-10 to the latest patched version provided by Aruba Networks.
What type of attack does CVE-2026-44864 enable?
CVE-2026-44864 enables authenticated remote code execution through SQL injection vulnerabilities.
Which versions of AOS are affected by CVE-2026-44864?
AOS-8 and AOS-10, including specific versions within these ranges, are affected by CVE-2026-44864.
Is CVE-2026-44864 exploitable without authentication?
Exploitation of CVE-2026-44864 requires authentication, specifically administrative credentials to access the vulnerable components.