There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by…
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)
The flaw is a command injection vulnerability in the PAPI packet handling of ArubaOS (AOS-10) from Hewlett Packard Enterprise (HPE). An attacker who can send specially crafted PAPI packets to an affected device can gain unauthenticated remote code execution, running arbitrary code as a privileged user on the underlying operating system, with no authentication or user interaction required.
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 22 Oct 2026. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.