PatchTheCVECVE-2026-44874: A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenti
CVE-2026-44874 is a medium-severity flaw (CVSS 4.9) affecting arubaos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system information, potentially enabling further attacks against the affected device.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 77%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-05-12 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-44874?
arubaos: upgrade to 10.4.1.11, 10.7.2.3. Exact commands for each OS are on this page.
Is CVE-2026-44874 being exploited?
CVE-2026-44874 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-44874 affect?
CVE-2026-44874 affects arubaos. Severity is medium (CVSS 4.9). A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability
How urgent is CVE-2026-44874?
Priority 23/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-23827 HIGH 7.5 UPGRADE UPGRADE A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that cou
- CVE-2026-23823 HIGH 7.2 UPGRADE A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated rem
- CVE-2026-44853 HIGH 7.2 UPGRADE UPGRADE Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Sy
- CVE-2026-44854 HIGH 7.2 UPGRADE UPGRADE Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Sy
- CVE-2026-23826 HIGH 7.5 UPGRADE UPGRADE A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remot