CVE-2026-44864
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
59/100
Published: 2026-05-12
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| arubanetworks | arubaos | 6.5.4.0 – 8.10.0.22 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 |
References & Advisories (1)
Vendor Advisory