CVE-2026-44873

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:arubanetworks:sd-wan::::::::
	cpe:2.3:a:arubanetworks:sd-wan::::::::

History

15 May 2026, 12:44

Type	Values Removed	Values Added
CPE		cpe:2.3:a:arubanetworks:sd-wan:::::::: cpe:2.3:o:arubanetworks:arubaos::::::::
References	~~() https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US -~~	() https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US - Vendor Advisory
First Time		Arubanetworks arubaos Arubanetworks Arubanetworks sd-wan

13 May 2026, 16:16

Type	Values Removed	Values Added
CWE		CWE-613

12 May 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-12 20:16

Updated : 2026-05-15 12:44

NVD link : CVE-2026-44873

Mitre link : CVE-2026-44873

CVE.ORG link : CVE-2026-44873

JSON object : View

Products Affected

arubanetworks

sd-wan
arubaos

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-44873", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2026-05-12T20:16:45.907", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled."}], "lastModified": "2026-05-15T12:44:42.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3310CEA-A66E-4374-91DE-5B9ACC49005E", "versionEndExcluding": "8.10.0.22", "versionStartIncluding": "6.5.4.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B106E8F-BD70-4427-8B0B-BE6A060DA43A", "versionEndExcluding": "8.12.0.7", "versionStartIncluding": "8.11.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CA7BD88-F241-4D60-9BA7-7409A1E435CC", "versionEndExcluding": "8.13.1.2", "versionStartIncluding": "8.13.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4311C56C-9E48-4695-A24C-C93FEFB6F354", "versionEndIncluding": "8.6.0.4-2.2.0.7", "versionStartIncluding": "8.6.0.4-2.2.0.0"}, {"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7825F9F-FC5F-4C61-A67B-5034E943F8C3", "versionEndIncluding": "8.7.0.0-2.3.0.9", "versionStartIncluding": "8.7.0.0-2.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}