← Back

CVE-2026-44852

nvd nist
Published: May 12, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: security-alert@hpe.com (Secondary)

Description

An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.

Affected (7)

Arubanetworks
2 products
Arubaos
Sd Wan
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Arubanetworks
Arubaos
From 10.4.0.0 to 10.4.1.11
Arubaos
From 10.5.0.0 to 10.7.2.3
Arubaos
From 6.5.4.0 to 8.10.0.22
Arubaos
From 8.11.0.0 to 8.12.0.7
Arubaos
From 8.13.0.0 to 8.13.1.2
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Arubanetworks
Sd Wan
From 8.6.0.4-2.2.0.0 to 8.6.0.4-2.2.0.7
Sd Wan
From 8.7.0.0-2.3.0.0 to 8.7.0.0-2.3.0.9

Related CWEs

CWE-296
Improper Following of a Certificate's Chain of Trust
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

References (1)

Source: security-alert@hpe.com
Vendor Advisory

Timeline

No history available yet.