An unauthenticated vulnerability in HPE AOS‑8 allows an attacker to inject arbitrary operating‑system commands through the PAPI protocol. This weakness enables the adversary to execute code with the privileges of the affected service, potentially leading to system compromise, data theft, or disruption. The flaw is a classic command injection, indexed as CWE‑78, and poses a high risk to confidentiality, integrity, and availability of the target system. The specific details of the injection vector are inferred from the information available in the CVE entry, as the description is empty.

The exploit targets Hewlett Packard Enterprise AOS‑8 software. Specific affected versions are not provided in the available data, and the product name within HPE is listed as unknown. Administrators should verify whether their deployed AOS‑8 instances are configured to support the PAPI protocol and whether the service is reachable from untrusted networks.

The CVSS score of 8.1 classifies this as a high‑severity vulnerability. No EPSS value is available, but the lack of an EPSS score does not diminish the potential for exploitation; attackers can deliver the malicious payload via the exposed PAPI endpoint without authentication. This assertion is based solely on the information available, as the official description is not provided. Because the vulnerability is not in the CISA KEV catalog, no publicly known exploits have been disclosed yet, but the attack vector is straightforward for an external actor who can reach the PAPI interface.