The vulnerability permits authenticated users to delete arbitrary files, potentially triggering denial of service by removing essential system files or logs. This flaw corresponds to an authentication privilege weakness (CWE-266) where privileged actions are not properly restricted. Detailed technical details are not provided in the official description, so the exact scope of file types and impacted components is unknown.

Affects Hewlett Packard Enterprise (HPE) systems running the AOS-10 product. The vendor has not identified a specific subsystem or version number, so any deployment of the AOS-10 platform that allows authenticated users to delete files is potentially impacted.

The CVSS score of 4.9 places this flaw at moderate severity, indicating limited but non‑negligible risk. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog, suggesting no widely used exploits yet. The attack vector is inferable as authenticated; an attacker must first gain legitimate credentials or compromise an existing session. Once authenticated, the attacker could delete critical files to cause a denial of service or other disruption. Because no known exploit has been documented and no public proof‑of‑concept code is public, the likelihood of exploitation in the wild is currently uncertain but not impossible.