CVE catalog

CVE-2026-44860

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with admi

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 25, 2026

SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpearubaosNot reported8.10.0.22fixed
CpearubaosNot reported8.12.0.7fixed
CpearubaosNot reported8.13.1.2fixed
CpearubaosNot reported10.4.1.11fixed
CpearubaosNot reported10.7.2.3fixed
Cpesd-wanNot reportedNot reportedunknown
CpearubaosNot reported10.7.2.3fixed
Cpesd-wanNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpearubaoscpeNot reported8.10.0.22Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.12.0.7Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.13.1.2Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.4.1.11Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.7.2.3Not reportedNot reportedNot reported
CpearubaoscpeNot reported10.7.2.3Not reportedNVD-CVE-2026-44860Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]