An unauthenticated adjacent attacker can exploit a path traversal flaw in the PAPI protocol of AOS‑8. The flaw allows reading, modifying, and deleting files on the underlying operating system. This compromises confidentiality, integrity, and availability of critical system files and could pave the way to further attacks, such as arbitrary code execution. The weakness lies in improper path validation and handling.

The vulnerability affects Hewlett Packard Enterprise devices running AOS‑8. No specific versions are listed in the CNA data, so all current and legacy AOS‑8 deployments are potentially impacted.

The CVSS score of 9.6 indicates a critical severity. The EPSS score, reported as < 1 %, reflects a very low but nonzero probability of exploitation in the wild. Because the flaw is unauthenticated, attackers only require network or local access to the vulnerable component. The lack of a CISA KEV listing does not reduce the risk. If the affected services are exposed to external networks, the potential for widespread exploitation remains high, so administrators should treat this as a top‑priority threat.