The vulnerability is described as an authentication bypass in the AOS‑10 API that grants administrative access. It permits an attacker to assume administrative roles without valid credentials, enabling privileged operations on the system.

Hewlett Packard Enterprise AOS‑10 is affected. No specific version information is provided, so all releases of AOS‑10 may be vulnerable until a patch is released.

With a CVSS score of 9.3, this vulnerability is classified as critical. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likelihood of exploitation can be inferred to be high if the API is exposed to untrusted networks, as attackers would need network access to the AOS‑10 API to leverage the authentication bypass.