Vulnerability · Published May 12, 2026 · Assigned by hpe
CVE-2026-44852Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface
High 7.2
In plain English
A high-severity security flaw in HPE Aruba Networking Wireless Operating System (AOS) from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the certificate download functionality could allow an authenticated remote attacker to overwrite arbitrary files on the underlying operating system by exploiting improper input validation in the file path parameter. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system as a privileged user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Wireless Operating System (AOS) | 8.13.0.0 – through 8.13.1.18.12.0.0 – through 8.12.0.68.10.0.0 – through 8.10.0.2110.8.0.010.7.0.0 – through 10.7.2.210.4.0.0 – through 10.4.1.10 |
Weakness: CWE-296 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H