A flaw in AOS‑8’s command‑line interface permits an authenticated attacker who holds high‑privilege credentials to execute a server‑side request forgery. By causing the system to send requests to arbitrary destinations, the attacker can ultimately run arbitrary commands on the host operating system. This server‑side request forgery can be leveraged to access internal services or external networks, turning the vulnerability into a high‑severity remote code‑execution risk.

The affected system is Hewlett Packard Enterprise ArubaOS (AOS) version 8; specific affected releases are not disclosed in the available data.

The CVSS score of 8.7 indicates a high severity, and the EPSS score of < 1% shows a very low but nonzero exploitation probability; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated SSRF, requiring an attacker to obtain valid user credentials. Successful exploitation could enable the attacker to execute arbitrary commands on the underlying operating system.