{"id":"CVE-2026-44864","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-44864","generatedAt":"2026-10-28T03:40:59.093Z","title":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol.","description":"SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.","published":"2026-05-12T20:16:45.000Z","lastModified":"2026-10-26T17:10:03.000Z","status":"Analyzed","sourceIdentifier":"security-alert@hpe.com","cvss":{"version":"3.1","score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-89"],"affected":["arubanetworks/arubaos","arubanetworks/sd-wan"],"epss":{"score":0.00315,"percentile":0.24235,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US","tags":["Vendor Advisory"],"source":"security-alert@hpe.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-44864","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}