CVE-2026-44873

{
  "id": "CVE-2026-44873",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T20:16:45.907",
  "lastModified": "2026-10-26T17:10:03.270",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de gestión de sesiones en AOS-8 permite a usuarios previamente autenticados retener el acceso a la red después de que sus cuentas sean deshabilitadas administrativamente. Las sesiones existentes no se invalidan cuando las credenciales son revocadas, lo que permite el acceso continuado hasta la expiración de la sesión. Un atacante con credenciales comprometidas podría explotar este comportamiento para mantener el acceso no autorizado incluso después de que la cuenta haya sido deshabilitada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise (HPE)",
          "product": "HPE Aruba Networking Wireless Operating System (AOS)",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "8.13.0.0",
              "lessThanOrEqual": "8.13.1.1",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.12.0.0",
              "lessThanOrEqual": "8.12.0.6",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.10.0.0",
              "lessThanOrEqual": "8.10.0.21",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T19:47:14.121440Z",
          "id": "CVE-2026-44873",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.5.4.0",
              "versionEndExcluding": "8.10.0.22",
              "matchCriteriaId": "A3310CEA-A66E-4374-91DE-5B9ACC49005E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.11.0.0",
              "versionEndExcluding": "8.12.0.7",
              "matchCriteriaId": "6B106E8F-BD70-4427-8B0B-BE6A060DA43A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.13.0.0",
              "versionEndExcluding": "8.13.1.2",
              "matchCriteriaId": "0CA7BD88-F241-4D60-9BA7-7409A1E435CC"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.6.0.4-2.2.0.0",
              "versionEndIncluding": "8.6.0.4-2.2.0.7",
              "matchCriteriaId": "4311C56C-9E48-4695-A24C-C93FEFB6F354"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.7.0.0-2.3.0.0",
              "versionEndIncluding": "8.7.0.0-2.3.0.9",
              "matchCriteriaId": "C7825F9F-FC5F-4C61-A67B-5034E943F8C3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}