Skip to content
VulniPulse
Sign in
Advisory severityMedium5.4HPE Aruba Networking

Medium [CVE-2026-44873] AOS-8: session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled

This medium-severity HPE Aruba Networking advisory covers CVE-2026-44873 affecting AOS-8 Mobility.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-44873 Source published Source updated

VulniPulse record published Record updated

CVE-2026-44873
Affected products & platforms
HPE Aruba NetworkingAOS-8 MobilityWireless & ControllersArubaOS
Open source advisory

Android app · Google Play

Monitor future HPE Aruba Networking CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration.

An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.

Affected product named by the advisory: AOS-8 Mobility.

Affected versions
  • AOS-8 Mobility 8.13.0.0 through 8.13.1.1
  • AOS-8 Mobility 8.12.0.0 through 8.12.0.6
  • AOS-8 Mobility 8.10.0.0 through 8.10.0.21

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Fixed versions
  • AOS-8 Mobility 8.13.1.2 or above
  • AOS-8 Mobility 8.12.0.7 or above
  • AOS-8 Mobility 8.10.0.22 or above

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade affected HPE Aruba Networking devices to an applicable fixed release: AOS-8 Mobility 8.13.1.2 or above, AOS-8 Mobility 8.12.0.7 or above, AOS-8 Mobility 8.10.0.22 or above.
  • Upgrade Mobility Conductors, Controllers, and Gateways to one of the following AOS-10 or AOS-8 versions (as applicable) to resolve the vulnerabilities described in the details section: - AOS-8.13.x.x: 8.13.1.2 and above; - AOS-8.12.x.x: 8.12.0.7 and above; - AOS-8.10.x.x: 8.10.0.22 and above.
Temporary workarounds
  • To minimize the likelihood of exploitation of this vulnerability, delete the user by issuing the 'aaa user delete' command.

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.