Is CVE-2026-44874 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44874 being exploited in the wild.

How severe is CVE-2026-44874?

Medium severity, with a CVSS score of 4.9, published 12 May 2026.

Which products and versions are affected?

HPE Aruba Networking AOS-10 Gateway.

Is there a fix for CVE-2026-44874?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44874 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44874?

Check whether you run HPE Aruba Networking AOS-10 Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44874: HPE Aruba AOS-10 Gateway improper access control in web interface

CVE-2026-44874 · Severity: medium · CVSS 4.9 · Published 2026-05-12

A security vulnerability has been identified in the management interface of HPE Aruba AOS-10 Gateways, which are devices used to manage and secure enterprise network traffic. An authorized administrator could exploit this flaw to access sensitive system files that should normally be protected. This could lead to the exposure of confidential configuration data or system information, which might be used to facilitate more advanced attacks against the network infrastructure.

Vendors: HPE Aruba Networking.

Quick answers

Is CVE-2026-44874 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44874 being exploited in the wild.
How severe is CVE-2026-44874?: Medium severity, with a CVSS score of 4.9, published 12 May 2026.
Which products and versions are affected?: HPE Aruba Networking AOS-10 Gateway.
Is there a fix for CVE-2026-44874?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44874 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44874?: Check whether you run HPE Aruba Networking AOS-10 Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in the web-based management interface of HPE Aruba AOS-10 Gateways. The flaw allows a remote attacker with high-privileged authentication (PR:H) to bypass intended file access restrictions and read sensitive files on the underlying operating system. The attack is low complexity and requires no user interaction. Successful exploitation results in a high impact on confidentiality as system-level information can be disclosed, though it does not directly provide integrity or availability impacts. Users should refer to HPE advisory hpesbnw05048en_us for specific patched firmware versions.

Affected products

HPE Aruba Networking AOS-10 Gateway

Timeline

2026-05-12: disclosed
2026-05-12: advisory

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.