CVE-2026-44862
HighSummary
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
Risk Assessment
Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, posing a serious threat to the integrity and security of the organization's data.
Recommendation
It is recommended to review and improve input sanitization in AOS-8 and AOS-10 components and to restrict access to the management interface only to trusted administrators.
Other vulnerabilities in AOS-8, AOS-10
See all- CVE-2026-44864High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44863High
SQL injection vulnerabilities exist in several underlying service components in AOS-8 and AOS-10. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters passed to backend database queries.
- CVE-2026-44861High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44860High
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries.
- CVE-2026-44852High
A remote code execution vulnerability exists in the web-based management interface of AOS-8 and AOS-10 that can be exploited by an authenticated attacker. By exploiting improper input validation in the file path parameter, an attacker could overwrite arbitrary files on the underlying operating system.
Original NVD description (English source)
SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management protocol. An authenticated attacker with administrative privileges could exploit these vulnerabilities by injecting crafted input into parameters that are passed unsanitized to backend database queries. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system.