AOS‑10’s PAPI protocol contains an unauthenticated authentication bypass that permits an attacker to gain administrative access without any prior credentials. No formal description is supplied in the CVE record, but the reported behavior indicates an improper authentication flaw that would allow full control of the affected system.

The vulnerability affects Hewlett Packard Enterprise’s AOS‑10 appliances. The CNA identifies the product as "Unknown" and does not list a specific version or model, so any deployment of AOS‑10 using the PAPI protocol is potentially susceptible.

The CVSS score of 9.3 signals a critical severity, though the EPSS score is not available, indicating no publicly known exploitation data. The vulnerability is not included in the CISA KEV catalog, but the lack of authentication combined with the ability to obtain administrative privileges suggests a high‑impact risk. The likely attack vector is network‑based: an adversary who can reach the PAPI service can exploit the authentication bypass without credentials and immediately gain full administrative control.