Vulnerability Description
A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arubanetworks | Arubaos | >= 6.5.4.0, < 8.10.0.22 |
| Arubanetworks | Sd-Wan | >= 8.6.0.4-2.2.0.0, <= 8.6.0.4-2.2.0.7 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-44873?
CVE-2026-44873 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated whe...
How severe is CVE-2026-44873?
CVE-2026-44873 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44873?
Check the references section above for vendor advisories and patch information. Affected products include: Arubanetworks Arubaos, Arubanetworks Sd-Wan.