CVE catalog

CVE-2026-44873

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated whe

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 27, 2026

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpearubaosNot reported8.10.0.22fixed
CpearubaosNot reported8.12.0.7fixed
CpearubaosNot reported8.13.1.2fixed
Cpesd-wanNot reportedNot reportedunknown
CpearubaosNot reported8.13.1.2fixed
Cpesd-wanNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpearubaoscpeNot reported8.10.0.22Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.12.0.7Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.13.1.2Not reportedNot reportedNot reported
CpearubaoscpeNot reported8.13.1.2Not reportedNVD-CVE-2026-44873Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]