Read the docs
TI-2021-08564 Aliases CVE-2021-26966GHSA-h36f-59v7-5qgj

SQL injection in Aruba AirWave Management Platform

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A remote authenticated sql injection vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. Multiple vulnerabilities in the API of AirWave could allow an authenticated remote attacker to conduct SQL injection attacks against the AirWave instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database.

Why it matters now

EPSS 0.01169 67th percentileScored 2026-11-07
Fix Fixed Aruba AirWave Management Platform: 8.2.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Aruba AirWave Management Platformbefore 8.2.12.08.2.12.0Patch availableCNA
  • Aruba AirWave Management Platform Vendor— Affected before 8.2.12.0 Fixed in 8.2.12.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:arubanetworks:airwave:*:*:*:*:*:*:*:*before 8.2.12.0VulnerableArubanetworks
  • cpe:2.3:a:arubanetworks:airwave:*:*:*:*:*:*:*:* Versions before 8.2.12.0 Vulnerable ·Arubanetworks

Remediation

  • Fix · CNA Aruba AirWave Management Platform Fixed in 8.2.12.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-26966
  2. 2026-10-03 Alias added: GHSA-h36f-59v7-5qgj

References

Advisory 1

  • TI-2021-07429 Deserialization of untrusted data in Aruba AirWave Management Platform CVSS 3.1HIGH 8.8
  • TI-2016-01864 Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to… CVSS 3.1CRITICAL 9.8
  • TI-2014-06880 The web interface in Aruba Networks AirWave before 7.7.14 and 8.x before 8.0.5 allows… CVSS 2.0HIGH 9.0
  • TI-2021-07445 OS command injection in Aruba AirWave Management Platform CVSS 3.1HIGH 8.8
  • TI-2021-07444 OS command injection in Aruba AirWave Management Platform CVSS 3.1HIGH 8.8
  • TI-2022-17649 Broken Access Control for some Web-based Management URLs in AirWave Management Platform CVSS 3.1HIGH 8.1
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences