A session management flaw in Hewlett Packard Enterprise Aruba Operating System (AOS) version 8 allows an authenticated user to retain network connectivity even after the user account has been administratively disabled. The existing session is not invalidated, so an attacker who has compromised credentials can continue to use the network until the session naturally expires. This vulnerability may enable the attacker to perform unauthorized actions, gain sensitive information, or maintain a foothold within the network after the account’s disabled status.

Systems running the HPE Aruba Networking Wireless Operating System (AOS) version 8 are affected, as the vulnerability exists across all builds of that major release; specific version details are not provided by the vendor.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Because the issue stems from inadequate session invalidation, an attacker must already possess valid credentials before the account is disabled or must have obtained them by other means. Once the account is marked inactive, the session remains active until expiration, creating a window of unauthorized access that can be exploited by threat actors with minimal effort.