CVE 2026 44861

www.tenable.com • July 15, 2026

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

Published : 2026-05-12

Vector : CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

Vector : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerabilities in AOS-8 and AOS-10 Exposed CVE-2026-44861 details SQL injection vulnerabilities in AOS-8 and AOS-10 command-line interfaces. These vulnerabilities allow authenticated attackers with administrative privileges to inject malicious input into unsanitized parameters, potentially executing arbitrary commands on the underlying operating system. The vulnerabilities affect several underlying service components, posing a significant risk to systems utilizing these interfaces. The CVE was published on 2026-05-12, and as of now, no patches have been reported. Organizations using AOS-8 and AOS-10 are advised to assess their exposure and implement necessary security measures. 1 sources 65

Extracted Entities

CVE 2026 44861

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)