CVE-2026-44873: arubanetworks arubaos Insufficient Session Expiration

Vulnerability summary

CVE-2026-44873 is a medium (CVSS 5.4) Insufficient Session Expiration vulnerability in arubanetworks arubaos. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.8% of scored vulnerabilities.

Timeline

1. 12-05-2026
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."