The vulnerability involves a memory corruption flaw in a specific interface of AOS‑10 that lets an unauthenticated attacker perform adjacent memory corruption to gain remote code execution. If successfully exploited, the attacker can run arbitrary code with privileges of the underlying operating system. This gives full control over the host and threatens confidentiality, integrity, and availability.

The issue affects Hewlett Packard Enterprise AOS‑10. No specific product name or version range is provided, and the known CNA product list indicates an unspecified HPE product. The absence of precise version information means all installations of AOS‑10 should be considered potentially vulnerable until a patch or advisory confirms a fix.

With a CVSS score of 9.6 the vulnerability is considered critical. The EPSS score is < 1% indicating a very low but non-zero probability of exploitation, yet the lack of inclusion in the CISA KEV catalog does not diminish its severity. Attackers do not require authentication, implying that remote exploitation is feasible over network interfaces exposed by AOS‑10. The combination of a high base score, the ability to execute code, and the lack of requirement for privileged access creates a high likelihood of real-world exploitation if left unmitigated.