This vulnerability affects the CLI service of HPE Aruba Networking Wireless Operating System (AOS) accessed through the PAPI protocol. It allows an authenticated remote attacker to perform command injection, leading to arbitrary command execution on the device's operating system. The affected versions include multiple releases from AOS 8 and 10 series. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of May 2026.

Successful exploitation could result in full compromise of the affected device, including unauthorized command execution with high privileges, potentially leading to complete control over the system, data compromise, and service disruption. The vulnerability requires authentication, which limits exposure to attackers with valid credentials or access to the management interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the CLI service and PAPI protocol to trusted administrators only. Monitor for suspicious activity from authenticated users and consider network-level controls to limit exposure of management interfaces.