What’s Vulnerable › Vulnerabilities
CVE-2026-44874: Authenticated Arbitrary File Download via AOS-10 Web-Based Management Interface
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-12 · updated 2026-10-26
- Weakness: CWE-284
Description
A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system information, potentially enabling further attacks against the affected device.
Affected products
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS): from 10.4.0.0 before 10.4.1.11; from 10.5.0.0 before 10.7.2.3; 10.8.0.0 — fixed in 10.4.1.11, 10.7.2.3
How to fix
Upgrade to a fixed version: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) 10.4.1.11, 10.7.2.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44874 or the next vulnerability affects your stack