An unauthenticated adjacent attacker can exploit a remote code execution flaw in the underlying operating system of AOS-10, a CWE-94 (Improper Control of Generation of Code) vulnerability that allows arbitrary code injection. Successful exploitation provides the attacker privileged operating‑system level access, enabling arbitrary command execution and resulting in complete system compromise.

The vulnerability affects Hewlett Packard Enterprise devices that run AOS-10. The advisory does not specify particular sub‑products or versions beyond the AOS-10 reference, and the vendor did not identify a precise product name in the CNA data. Administrators should verify whether their network devices or management controllers run this version of AOS-10.

The CVSS score of 8.8 indicates a high severity level. The EPSS score of < 1% suggests a very low exploitation probability, though the unauthenticated nature of the vulnerability still elevates risk. The RCE is not listed in the CISA KEV catalog, but the severity warrants urgent attention. The likely attack vector is remote, as the threat is described as an adjacent RCE that requires no credentials.