Authenticated remote users with high privileges can exploit command injection vulnerabilities in the AOS‑8 interface, enabling them to inject and run operating system commands with the privileges of the affected mechanism. This can compromise the confidentiality, integrity, and availability of the host and connected services. The root cause is insufficient input validation that permits OS command execution.

Hewlett Packard Enterprise’s AOS‑8 operating system is affected; the specific product variant is not detailed, but any deployment of AOS‑8 running the vulnerable component is at risk. No vendor‑specific version numbers are provided, so all releases of AOS‑8 may be impacted unless otherwise noted by HPE.

The CVSS score of 7.2 indicates a moderate to high severity, and the EPSS score is < 1%, making precise exploitation likelihood difficult to quantify. The vulnerability is not listed in CISA KEV, suggesting it has not yet been publicly exploited. The likely attack path requires an authenticated session, which limits the threat to users with legitimate access but still permits attackers who compromise credentials to launch arbitrary commands.