The vulnerability is an authentication bypass (CWE-287) in the API of AOS‑10 that allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could grant administrative access, modify system configurations, and enable access or manipulation of sensitive data.

Hewlett Packard Enterprise AOS‑10 is affected. No specific version information is provided, so all releases of AOS‑10 may be vulnerable until a patch is released.

With a CVSS score of 9.3, this vulnerability is classified as critical. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is that an attacker must be on the same network segment or otherwise have direct access to the AOS‑10 API, as the described attacker is unauthenticated and adjacent. If the API is exposed to untrusted networks, the likelihood of exploitation increases.