AOS-10 and AOS-8 contain buffer overflow vulnerabilities in an interface that can be exploited by unauthenticated adjacent attackers who send specially crafted data to overflow a bounded routine. The overflow permits execution of arbitrary code, allowing attackers to run code as a privileged user on the underlying operating system.

The vulnerability impacts Hewlett Packard Enterprise's ArubaOS (AOS) 10 and 8 appliances. Any deployment of these ArubaOS versions should be checked for the presence of the vulnerable interface. Versions are identified as AOS‑10 and AOS‑8; other ArubaOS releases not mentioned remain unconfirmed.

The CVSS base score of 9.6 indicates critical severity, and the EPSS score is < 1%. The vulnerability is listed as unauthenticated, so the likely attack vector is an external network connection to the vulnerable interface. With no available public exploit and no listing in the CISA KEV catalog, the risk to exposed systems remains high and the exploitation likelihood remains low but non‑zero.