An unauthenticated buffer overflow exists in the PAPI protocol of AOS‑8. The flaw permits an attacker to transmit crafted data that exceeds memory boundaries, causing an abrupt crash of the controller service and a denial‑of‑service condition. In addition to the availability impact, the vulnerability can also corrupt data, thereby presenting a limited integrity impact; there is no evidence of confidentiality compromise.

The affected product is Hewlett Packard Enterprise's ArubaOS (AOS) version 8 on controller devices. The advisory does not specify which AOS‑8 releases are vulnerable, so any instance exposing the PAPI protocol is potentially affected. System administrators should verify that their controllers run the affected versions and plan for patching.

The CVSS score of 8.2 classifies the vulnerability as high‑risk to availability, while the EPSS score of less than 1 % indicates a low probability of active exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The limited integrity impact means that in addition to service disruption, data corruption could occur. The likely attack vector is remote unauthenticated sessions targeting the PAPI port, which can trigger the overflow without authentication.