This vulnerability in HPE Aruba Networking Wireless Operating System (AOS) 8.x involves improper session invalidation. When an account is administratively disabled, any active sessions established prior to the disablement remain valid and are not terminated. Consequently, an attacker or user with compromised credentials can maintain network access despite the account being disabled. The issue affects versions 8.10.0.0, 8.12.0.0, and 8.13.0.0. No official remediation or patch information is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability allows continued unauthorized network access by users whose accounts have been disabled, potentially undermining administrative controls and access revocation policies. The impact is limited to confidentiality and integrity as per the CVSS vector, with no reported impact on availability. Since sessions remain active until expiration, the window of unauthorized access depends on session timeout configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider reducing session timeout durations to minimize the window of unauthorized access after account disablement. Monitoring and manual session termination, if supported, may also help mitigate risk. No vendor advisory content is currently available to indicate an official fix or temporary workaround.