An unauthenticated SQL injection vulnerability exists in the PAPI protocol of Hewlett Packard Enterprise AOS‑8. The flaw allows a remote attacker to send malicious SQL statements to the PAPI interface, causing the underlying database to execute them. Successful exploitation can lead to reading, modifying, and deleting sensitive data, and can also interrupt the normal operation of the service. The weakness is a classic input validation flaw.

All Hewlett Packard Enterprise AOS‑8 installations that expose the PAPI protocol are affected. The advisory does not specify particular releases, indicating that any configuration using the current PAPI implementation is vulnerable. No version information is provided, so the risk applies broadly to all current deployments.

The CVSS score of 9.8 classifies this bug as Critical, signifying that exploitation could have severe consequences for confidentiality, integrity, and availability. EPSS indicates a low exploitation probability (less than 1%) but the score is non-zero, suggesting the vulnerability has not yet been widely abused. The attack vector is inferred to be remote over the network, relying on unauthenticated access to the PAPI endpoint. While exploitation is technically possible from any network resource that can reach the endpoint, the likelihood remains low. The vulnerability is not listed in the CISA KEV catalog, so no publicly documented attacks are known.