The vulnerability is a memory corruption flaw in HPE ArubaOS (AOS) AOS-8 that can be leveraged by an attacker who has authenticated local access. It enables execution of arbitrary code with privileged rights on the underlying operating system. Once activated, the attacker can run malicious binaries, alter system configurations, or establish persistence.

The affected product is HPE ArubaOS (AOS) AOS-8. No specific version numbers are provided in the advisory, so any deployed AOS-8 installation that has not received HPE’s security update is considered vulnerable.

The CVSS score of 7.8 indicates a high severity. Exploitation requires local authenticated access, limiting the threat to insiders or compromised local users. The EPSS score of less than 1% suggests a very low probability of observed exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, local privilege escalation to arbitrary code execution is a critical risk that warrants prompt patching.