The flaw is an authentication bypass in the PAPI protocol used by ArubaOS 10. An unauthenticated attacker who can reach the PAPI interface from an adjacent or local network segment can trigger the bypass and obtain full administrative privileges, enabling modifications to system configurations and access to or manipulation of sensitive data on the device.

The vulnerability impacts Hewlett Packard Enterprise’s ArubaOS 10 appliances. Any deployment of this operating system that utilizes the PAPI protocol is potentially susceptible.

The CVSS score of 9.3 indicates critical severity, while the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have network access to the device’s PAPI interface from an adjacent or local network segment. Successful exploitation can give an attacker complete administrative control, leading to high‑impact compromise of confidentiality, integrity, and availability.