A stored cross‑site scripting flaw (CWE‑79) exists in the SSID processing logic of ArubaOS 10 and 8 Instant web management interfaces. An unauthenticated attacker can inject malicious JavaScript that will execute when any user views the page, enabling data theft or manipulation of configuration settings in the victim’s browser.

Hewlett Packard Enterprise ArubaOS (AOS) Access Points running versions 10 and 8 Instant are affected.

The CVSS score of 8.8 indicates high severity, while the EPSS score is currently unavailable. The issue is not listed in CISA’s KEV catalog. The vulnerability can be exploited from any host on the same local network that can reach the AP’s web interface; no authentication is required. An attacker achieving the exploit would gain client‑side code execution, potentially compromising data confidentiality and device configuration. Due to its high score and local‑network attack vector, it poses a significant risk in environments where AP management interfaces are accessible within the LAN.