This vulnerability affects the web-based management interface of HPE Aruba Networking Wireless Operating System (AOS) versions 8.10.0.0 to 8.13.0.0 and 10.4.0.0 to 10.8.0.0. It allows an authenticated remote attacker to perform command injection, enabling execution of arbitrary commands on the device's underlying OS. The CVSS 3.1 score of 7.2 indicates high severity, with network attack vector, low attack complexity, and required privileges. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of May 12, 2026.

Successful exploitation could lead to full compromise of the affected device by allowing an authenticated attacker to execute arbitrary commands with high impact on confidentiality, integrity, and availability. This could result in unauthorized control over the device and potentially the network it manages. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the web-based management interface to trusted administrators only and monitor for suspicious activity. Do not rely on generic mitigations as this vulnerability requires authentication and specific conditions to exploit.